Please report security problems privately, through GitHub: open this repository's Security tab and choose Report a vulnerability. That creates a private advisory that only the maintainers can see. Please do not open a public issue, pull request or discussion about a vulnerability.

A useful report says what you found, how to reproduce it, which version or commit you tested, and what an attacker could do with it. Fixes land on main and ship in the next release; older releases are not patched separately.

• README.md, "Privacy — the vault and privacy rules": what the vault hides, and what never leaves your node.
• architecture.md, section 9 "Privacy and access": who may call the daemon, and what each kind of key can reach.