| Version | Supported |
|---|---|
0.x |
Latest minor only |
< 0.x |
No |
Please do not open a public GitHub issue for security problems.
Instead, use GitHub's Private Vulnerability Reporting to send a private advisory.
- A description of the issue and its impact
- Steps to reproduce or a proof of concept
- Affected versions
- Any mitigations you're aware of
- Suggested fix
| Severity | First acknowledgement | Triage update |
|---|---|---|
| Critical (remote code execution, key disclosure, unauthorised funds movement) | within 72 hours | within 7 days |
| High (auth bypass, information disclosure of session material) | within 72 hours | within 7 days |
| Medium (DoS, inconsistent state without funds risk) | within 5 business days | best effort |
| Low (informational, hardening suggestion) | within 5 business days | best effort |
Critical and High issues will be patched and disclosed in coordination with the reporter.
In scope:
- Code in
pkg/andinternal/published as part ofgo-derive. - The signing path (
pkg/auth,internal/codec). - The transports (
internal/transport).
Out of scope:
- Vulnerabilities in upstream dependencies (please report to those projects).
- Issues in the Derive API itself — report those to the Derive team directly.
- Examples in
examples/that are clearly demonstrations.