Skip to content

Latest commit

 

History

History
326 lines (300 loc) · 19.3 KB

SECURITY.md

File metadata and controls

326 lines (300 loc) · 19.3 KB

Security

The maintainers of libwally take security very seriously and are committed to addressing any disclosed security vulnerabilities quickly and carefully. If you find a security vulnerability, please report it to us following the steps described here.

Reporting a Vulnerability

Privately and confidentially send us a description of the vulnerability that you have discovered using an encrypted and authenticated channel. PGP encrypted email is preferred. Our contact information is given below.

In your report, please include as much information as you can, including:

  • a description of the vulnerability and how it could be exploited
  • its potential impact (e.g. privacy leak, denial of service, theft of funds)
  • steps or code for reproducing it
  • a proposed patch for remedying it

Also, provide us with a secure means to contact you with any follow up questions we might have.

Considerations

Please take care not to violate the privacy of users in your report. For example, stack traces or exploit scripts sent to us should never contain private keys or personally identifiable information.

Give us at least one week to investigate the vulnerability you found and up to 90 days to fix it. Also, please give us reasonable advanced notice if at any point you intend to disclose the vulnerability to anyone else.

In general, please investigate and report bugs in a way that makes a reasonable, good faith effort not to be disruptive or harmful to us, this software's users, or the users of dependent projects.

We will take care to inform the maintainers of dependent projects.

How to Contact Us

Primary Contact

Jon Griffiths jgriffiths@blockstream.com

Please use the following PGP key for communication:

Email: Jon Griffiths <jon_p_griffiths@yahoo.com>
Fingerprint: 129EE55E90E6E7BB5ED3530DFD9FCBA3C53CED20

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFcpb6cBEACshfpRfpq1su/TdjBphD1kBeyJbU5FhsX3LbOmyWERcvqH8ES8
tKd0oVrt8pGj1R+GLrmT/bKA0qizsKzB46ErkCFqTrZIJc7c/dXB/N3ZqwRLi6zH
kfA9llqEd1fHCjFpNAGE9KFHqdVq2MGw0tCqRmOX+2ny0PqEe8mluCZV5drsDq4M
DDUVQPGP8JG0Z0J03jyOCHWz5D7E7vGazl5RhMZu2109xEM26vevUd1y8QLsjWLS
vyFjNKEgNGkxQnJ3JL5JLnlduiZQS8lM2KIpZw8G8sxtE4iuc/FQLWy6F9Mb23mg
eL9OYxVhY9/QS0EUS48/lqc2oxGHnDCn1U5jUK9ihMwLupgY8glCqXtHf0jqVDjV
QThqHVdxRqYuvlgaRSDf7YKgV8QOG0/j2o0u0Ums7zfA+yvtO0rgqKpb7SgQU3cx
y+JX1Ko8Aoa/KQEv44LuRLwBZ7B3WmBcitv/YHtdYFyYADCMwKaojG5Rh7sxgwgp
3788Rm81EpqjNlj1IoFBQ4UU7aRgcXnngUTSY3JTZ8XEmvH6Q1i51L7nfXcg1Nkz
E1Fuz4NGedh2iwHmGLUxkSqUgyavvmZ+OxiVr/lxIEKKEbR+nuE5yP6dk3Uv8RjA
/l+Ak1Tu6EWvCYFMPb4asOtKu2Z09gpXabeyMC17hsHsAfmqEkSKdgZzcQARAQAB
tClKb24gR3JpZmZpdGhzIDxqb25fcF9ncmlmZml0aHNAeWFob28uY29tPokCPQQT
AQIAJwIbAwUJAeEzgAIeAQIXgAUCVylwhwULCQgHAwUVCgkICwUWAgMBAAAKCRD9
n8ujxTztII8qD/4zlQ6q5lwBHkyO2ZiDkh33kKllUg2DdbYG7or6W8GAxWs7Naap
SRjKzsh6j2emP1SWTKi/wRSiqk7xO7FLD29OTuIMYTox6QPm/hTLw5GqQ8z84lJ0
cIn+l3ntxW10l062nsp/bfVIt6vg06RbQtppdp16Ki6EhYLojsZ5F8K9+55wc055
OBll4QNGy/jcdyfYtjrddTadnqjjBEub8sx5cCqfSQiqAY/rIAa5DqMcvf6DS56L
0uLpcIDNn9knc3STQUTKlide1tYOSEUYsE705FGlrY0tJzvt2lHKq8xfaj4mOHx0
k9Ji5HiSrTM+PBcYZ/mdQgw3JTLaOyPCpw8zIUJKudkqiBYAVUJjQfHHq7YsmMUg
dqQmjG5Mu99+YYNRhMoCGcrFdsbtrpS4F/vf/WSYstzw8NXIcroFB/68IYWqaeSM
sGVXpV7wKmeNSnaz1xBrdVhD+2m9Kyg9fttfPHLyN3iQipoFDGyBGeL5Iej+Nn4K
MR6fT1lxQilLBrtTv6rdWMIPDbiey0nUSRC6IkFlPB8R+fFdUx9gNSARzkZrl7lr
s0yuEV+6BWfxPwcYlNSfJJEovOVvbogvlx2NTVzXCXd6o4sdH6CKPTeAoIHPUJ+8
zLQAq8C6bWa/AyfDZzymFraiiwA6SDb3yWUpQPQFyqGPTC5cm/pD/IOJvIkCPgQT
AQIAKAUCVylvpwIbAwUJAeEzgAYLCQgHAwIGFQgCCQoLBBYCAwECHgECF4AACgkQ
/Z/Lo8U87SCaSg//am7TvXy1SX13kCHrzeU933z1d81MMFHI47mvBYb1OzYROM5z
SVD/82XI6kYbzPAf74Tc2BlaeEKP5pfoSjGT5x97o14tx3HuYG5LVjVpgCxI1yuP
XzyLRU9JWJBMkeWC8obZd/4P0iFELylLC570LuKsMx1G00Luxsy2xXXSCOhdJY9f
598qehqACTKCXYLMUspGqgC/nJDCUAzi+mXqybdhTh9Dd5sFL0OIL+/NIDlT4/HE
KOBK1lVBUQiH5TJLhaaRijXlUTYntBba5uu0j/PUNYJ+FKVp/YNcA7QPJQOpVxjX
RaNgN+65UswA5SQmbr+k5pXmBhIFW9Q0pW6C5c4bLrH9p7jneJJQJlOevf3WGnjm
9Qkubmz9COwzmBMMqixNoHtElsjAwWs/o1W6va+qcTwkrGfyQMMS8pZEc0WWAaO5
0MrOyhc3Bz+MV5/lWeV10zR8SHGjXQSoE/zlKi7rKtZr9jLg3A3JabH54LmTbbHT
ARK4GWYXMqrCAzN+Fn2AQvOoU3xA3HEatKDxoPd9tGRmr8if/jEkjlJ336E/oPq7
hxEX42qKyqbW6WED937eSuKIZoMGusdp0S778NOa9E+KyizARAUui50PAeL15K9G
h+0VRx4VxWyFk8Ra/bVs9CmDUciMmV2wx87LAU+30ak2K2M29Vkhlm8/zB+JAj4E
EwECACgCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheABQJZCv4qBQkDwsHuAAoJ
EP2fy6PFPO0gBGIP/3zw8WZRURPQfQ0hC8UQc96uaPU7IBQrMXDBj+y8XBNLCFJX
UhT3rS1wlN5foCt0DxkgLIAU73GUJ0Q7qG0Vcap7YWSpcw6y6Ih7vxVRzAqe8nfC
IznSK28uhJgVErelNLOYLqiV3nO5oHOSVLL95JwvexPw/zIkbSQwr7mX/Rica8iG
qEGXqRgjasgLz0BhR7OozzgdXHmVcwtQ2x9t5ySso/doj+RrSTdCbSw+5l8fZOC/
HEIdOWrjkL5r84EmZHfb1sbk0CAPZeX1lnaXSitYenb5Yl90ejSOjGwqV4F+/ZoA
LspvU1SeDiASQaFaK/gxuVeGVduYcbXriD06iGsMzX6BkathV/hPd2naneT4T85K
SgjUs9Mby9/gy84uNDDsH3PSBlYJCH+GuVkafiwD9GZc8sr5KJtCIFA/ZCJk0omJ
Mdod8QaWKwCpiJO4ynnliiBnXKMHABYQBR4B68fz2RduQ94tnGEdbyJbakPQ1viL
7Gr0hkau6Rn/p8qzH7ZG5zI1N6e1TUTwiRsDJK82N/R6hHj2ovf6oDp2oa5/0E1g
AlzstP4b2BmVnyEivc72smRbPwqN4kyoc6xUQsH7nWmXdw05uHW583et9Aa8R9My
65ubRnk6TWkwcUycJZMzPI9UJCIPj8vDHw8+6esVR+iaf60YYdzRPIZ7nQjjiQI+
BBMBAgAoAhsDBgsJCAcDAgYVCAIJCgsEFgIDAQIeAQIXgAUCWu+aGwUJBadd8QAK
CRD9n8ujxTztIMOkD/49LKpwugFKAMtAN8tg5JmOmvFvzUgHKNaI1QLDw/7CB1E8
3+zSTEge9MQme7pBeHbf8wHqRIOEQJuygmYcsXNdDhe2cDbuKKhBRnTiYyzZojSH
7Q/+21N4e0zIsizFCEwDFmIJa3YFGmVH28Cql2AtopW4yv9ZR4D/Fe9DF3um9llg
rZEOyIysJuj56rGUuRs1779xs+taVV74n3Vt6CY+zE0nbZayzac1G9SmowKeJjnY
aLoaxthpac4ysBDBfJaIj3ddU1exXiOJJYrOQ43h2iRmcpVRZ6QOtGRIsixLc/Sx
8x2ML4iHtY1V37oFCLa8PZs35Q/Jtbj/CRmM/WpmnCNR3e8rHGwHdJiV6oLChbE2
BQuhQdxPSDPGJ2Z6CBpycWtCl2cH4INdbvjQyqyhRyWugqUSYkhzVe0q3VA5sJMj
otHeSSsBV8PeakjV3hQ7idH4DFwExKrJOm2Miif/MKJSOx14lWPeshHOIivwB3M/
mt1hVHp512GuNdNNPWx3F3kPZbk2n03WL6rNb5EgA+6py7pEDOZgy9BmzAkTz3cN
0cySdqESS7oPpWfWDjYYJo4KndKdfmgWCf3y4HbCW01tjgSC4hk8sqmLOEhQ+s1h
vTB9U9jFtszCyNOrzsDqEDpgu8PFWGdOr+Fg5bQtLvf40dlu8JaFmllDpCALHYkC
MwQQAQgAHRYhBBM+rBeUNvFKXPG3lIYP64BOZpMgBQJboUJGAAoJEIYP64BOZpMg
0CMP/iNHXbGqGH0N7+BjwV4HrQxQ5+G4LEVu0EIq0Ut6n5I0ie5sAhOj/AKATLTx
CpQiAkuNb3VVXmmVgKAV76ClKzIr5/n0j+Iy+Pgjy817swVt56edeBZxv76pduaP
wUnfDxV0+SQpzBR7WavZ9v5cQFj0YI/vAlCeOSEDbqbZuu01f6WzhBNAk4VBV09q
T7/HgUCeRF4GpPF+jUMjM5bsH+9Xizf9CKLixw++KvcMiyzMFfruWSLm7m1lyAws
rItz1HKWvbrs59IRVs59QkmwD6e/LaZ+mycco95RarRvG/sgPEBIhUfdoevgWTIy
WRgUgY1YWEtOSpDHEnnwG/qPgqakrYUsPD3N42szqisLOxD9qWSGJnQJpcbbeAEO
byaMN7fVFAZ0AszDvUKiDb3ZEUI/DWl3P2+Rs4a0lXXAeL2itdikunZshvDyuzk+
LV0BMNMfz232spxqZTYjUFGM19KA2nRqlmL2RX+vz8066EZpf7V84g2Ai+3jVlUJ
K/sBcFblwwpXcvpBqumeiWD01GI/DT9yU98Qm41uPk/5J+/NKAXzaOofEAlxPCN0
R6U4nrTwslELdahh1QGVLUZA2wasLmwpXrs6/7lI3HQ3Y9A2zonsfwVCTHpIYJn0
wT287lsehVjkqiK/Q/ectsgfy1qK51kYcdqLpcf0we4qIOaQiQIcBBABCgAGBQJb
p5nLAAoJEKJtbZ/giO1YFSkQAKh84zOXp63A3WhAqpMODwIOc3bHhfgD2emJAwBA
cvJ0jF6gQeQceWtoW3Fy0ivA/LQCX6cemriyJNOUHXAiilzcXQH/1VuUatD6K6X7
eCbbilah0EMrUG/PLcvf8KlicazKwUpv9lLAdE5horUaq56QcGzWxL9OQkHJKpTp
aHo3Y4eEiXiAJr18t6OGuP3sqvPqOe7RuS9gHGyfVRb9cg8k1T9f4WdCNyoyAsbd
I2I7LtTln2xY/DDU9ynzOkwpxXCrxYmE3zMcPCTe5xITQ3JkprWIGDKFrxomYx4M
8DF9gtDLzOzA+7gHNbzsJzA2mUpvoA3ajz/GHNZUdh0yIeGmZKQbaA1uONUZTlxx
dRdoNTXl2AQ8NbD7VThxIj3ib8v4q6NpohPrzYZ+PmtUdd+stFWxkafB44LgjfbR
WO/JE4zVwrfykDRoMGwL4nCgcssyuCSDdtYaKgIiiUqZNyDakzcMMI6TMT/VfjXk
vjZYTOtXGsFJQRg9L9AEtVIsOB/IkChPL1AyzdQjK15jlQTo0qw7sr0zysFMyNML
rr49Sjcv0+cO3MHyT7Fi7gvHLVy6Lh6cvDtjaNUgYfrslimQdqUS7W7piEOKlADY
eUD8YFxmtHSkqmkdYW/ULYOlkp2nzjlfOG0GGfvibz1opIF9aSZH6on7eox/DS+i
DjVJiQIzBBABCAAdFiEEDXrynMkm7zNZa1t+hkxNCRC0MNcFAluskTIACgkQhkxN
CRC0MNfdxw/+KxfOpVzONnv62CBFG+XuzJ0yWNFuVvEJGwcFVKBozlpw5I6SDxtv
fL+BbRkuXMKI9vrXbvC8QKkOfz2zVTiDPYwXqnq6YeN+Tp5WKfsNWxDXLfTLS8nS
mPektqH5oWSCCqrGIYjGRBQ2vC4c0vjMHLRmXHMjuB7brC8XMYTIA3DhbN9wG3+F
dkTTjKIDrMfdn4gGOEmAiYYQuwjnnOAG9WIOfmsIuda5+taIId7mamV3N45rjn+k
uYJ9p0TsRoOM1gKyrrwFPSY1z354Vq9hcwOoCgNklATlEx+MkNG5jNmeXH0aH4HW
QqoryrJH+5+KNKKjkBe2vg6JXDDICAF6L/TtYhLxLrfz9G+ZIrU2x7O0xB8XXORY
X0fskhMqf0HdbJDfmHDWUmsG07FGCG9ppt/DC5QQYjnH+znSfug1/1IN9fo5FIDe
LgMjaa7CdvmVpdwTqZHuE9EcFqp2WjusmcPWW9npd5vHYpL7WxFzOyqQ1Gtjphmo
CkoWHKP1NpBZ106QHoUvmyfGQgz1GTfvzpH+YU/9rPbidJOIe3LkHXCFg5Txox5m
kf+85FFi5myCuxoRFIUu8oP2XMwPtLc1Bnt3bdKJmP+J+WcSmYLDdoBfzROL0M2i
6YAC4Grd6Jt2d5vMaCzqYFK00gvYQON6543YLGS6tTHPiOo5LIrXi1SJAhwEEAEC
AAYFAluk8hEACgkQAAI0BZy1BxUScBAAq4EiTtzbO91FN2vOHq1TIxObnw/GA5xt
Z7y7uKV9ZlrboyJ/L9WUT3JNRWPejhTeXIAz404Zqu0wsf1SJ6G6Dk1fN/xzpkOi
SoG4TsY3aw2JiuNzqd3GF6DipD5LMyoldlEsJAj2Xq43XnD0ZClT431jkj2EP03X
37xw/8LyFPdqovoGtr/a4ZVQBcJbuHxJdYZ4orDKSfnwEj4Mb9b29pEza22HKs3d
thc3aTMTOH9K2a/3X4aN1li7KfFwHgW+L7BFkbd9APpfgAb1VwcZLZnDYrEiIxzj
iagJqPH1PfGDNGju+K42Mtb/T3f7BnwyTuOhRNfOxIzGofpjYDkl5GhSGk5HSPxg
hXZvpCEn5pTDpqI/yzbw2j+njiLnTZvjsTMaOccw6i1b0V6K4fMOXDdc0LbE5rBS
37/izR4DHSRwCP4eVpz1OWkyx3FhjXNVCAW2xRUheOP+REjwFbZGWyiNTl9AtDki
85BVNdvqVKk2GhxK5MC/0A3k0qowy6FIEJcpwdf1wCbH3VQ0iOGCLI5baHOP7/WZ
AlyyfZhrGVlN2lqI9t9Rs8VPlig7we/HK0flxAiV/Rx0wvTgWEOXgaoio4DFhMdh
+Wf3eQU2R20C2BZEvdtzh77HaG+GRTbRYwZpiUsrMsIni8/Zb51HunAVNf0t60Se
i6Ry+XufyQGJATMEEAEKAB0WIQR0gJCTeNVE6mttzrdTWxKYC7ik0wUCW6HPZAAK
CRBTWxKYC7ik00sEB/0d7YWDsv1xSr9emZBwVkLaTHhwSrD4hbvYkO3CzQ4td/HS
0jlraIzI7uZJrA0KXELSMGfa8I7h8khMCl6Es6xeJs46uv/Bk/9ccLqvfwMSGD7r
uURMYPXaQqba/oYCHXhIlwjDqm/J8lgdJOfxUmml26qG23UO/g6hxSpsMcoNZ+qx
Vnl1Xp9poGKo2CwPfIGgJcc6wDU26OlWQluuux0ErtYa1o6DdmJikRnYxLxamo0J
mbL+YWeOC1CZd0M3bIjK2y1nrtnFglAuC5XuZYCGMNDnQO0lJNrQS3OezD7nNXJ7
xZZso9G8KbK4i4Ube7KHMND3mHLCzaYyyKLItmoNiQIzBBABCAAdFiEEjMl02c/Q
NNzu0hOwKlfgphDX8ZwFAlug8mcACgkQKlfgphDX8ZwjQg//bfCvWSSq/XSNTdYc
tSysVaVHICm4BdOkMh6Gtb/1TJ4fE9mHnfza2h3zgQF3ayOk4JC0O/Ybfsm8HFXN
c7RBh+IQJ1DclXkhH+e1dXyPFuMR5SWR1dL4PMvyHfT2iUe7Ibud+EUDFWFA1CC9
L/fEWfW3+mCizFI8IgoHObL6U0+4xATICacuTyNFtK90IWNcA/DuPm7x467qY1f7
PmEfrPhXVrGkqy1kAswZz+pKly3S/FOpeqN+o5B/tA+X25v0R4XUPYsp3LToDJX3
x6iPq0vrDQFkHG3SXdGBgR/ipy3bObSOguE6iDg12ZxNQbmXB0ggHjurVv6/9Twy
wN6UDD9iNs0JDXQ4fXbHs5qYChhxzGeU6dNGzqk0PC6j/ubFyb1zWqLTToa0FZuh
HS1Z2A6amiw7VAXXobjZ34N0lr9qnu/BrOqE7dMnvK/CX6T9mM5bGPf8zKvI8j29
OTtS9BGq0LDjGkTuquLUzDodvZHeVinJ2IKLAmrrM5dhhDjDRamIpXIcUrG0akhS
exMP/2XLLNpz4Oa51AWf7nswc39s+Y3mFeO2qYdEDHXRvBESbZid/W7olVFbABnV
N/NGkDJmCZL3vRojnVBX7vv+7WHICsR50nApov6Yh3VO1XKooVdgpIOremGMlxR6
xJ6PNW3YuUa8kPCM+EwafBSdF/eJAj4EEwECACgCGwMGCwkIBwMCBhUIAgkKCwQW
AgMBAh4BAheABQJfAiUnBQkJuej1AAoJEP2fy6PFPO0gN1cP/2jTMkl04rRf0JgD
IuyUAC5ZDYxjd0qnTtMLE1bJxOdAh5a450PdQWQFjqyRWlfpQlznxrO1O0H/x1/D
5ZNgLU7FlXYmuGj86NfIIiUxH+MbkjiQ7VUgNt04PRqt4GpWWn9O14Xxz09JSVA4
19lC8FVt9M2JzUEi/hAte9GsXr0FHo1hDBZeXpGvZi8RbnbkEv+PXHiAWlpPEKeu
w6h9qej1r3DrYYPOmnYGc5R1MygDQe4Wag3owx3QOTx9pHV4TCaUtLNL04lzDgjB
cSjQNskzovi8AAnpMjU9Igvly+eD+vZ5019K42UJAkD3QM5u9xt8tkztPn3/GZgM
NpGrubWph5aEYx0XI/+ywBj52VfVrHf07htS+o+aj1EJDdB1TsXcPK/ecu/pF0z1
xfEmKYhYdBPHIfymocFW316kOl5kGryuZC2sEDUFveihadC4C80XYPLycIelQ5vt
3lJp5CbdbZNGSEpW7tiB1sjKDAO1+j6O9mqG9opo35iTGlLkJYNRZQmzIytAvLKg
YNt9h9+/tzEZxpyLtPddXiVzieCTpf5lf9JWrAHfE9pf+/nHy9TU3KlQ+5JFq9Jp
ZYtXmnjz4sXsU/SzZc8ZgVfa81ZB9ZPpWeTytgmIvZ8IB0dg9J78VQLsomgNDGXR
rQNLeK0S9XuwzBEdHW4D1NXGapQRuQINBFcpb6cBEADHIXZN1ns7lR1sG/+WxnMJ
u5EB38/t16Rd/f+KmNKk+iyHdHxHALERoIP7P0BUhm259szYbMM6VJp7Rm2fUN/7
BbtTdoCdignuna4bENX3RI9lCTXU3QbXo4JT9EcnoIhwosV1XxBASqAdc5Yosn7R
uQP/yXKjQz6Auce95NGRPKzgSGkgWRA7mzzRkxCQ5QIL2CmTi4KsXyJWCKLPst3u
xJpW2vucouRdBQoQ1a1gX76RFKIYaKLrbJ6tVzUYrve2LHCs8Q4mNVy/LrxKNHtv
9muilTYEyOdXf1R7zHgTH7QW2xoS5Bjt0iaOx6wdSc4xwx4uQMuIHyveT8uagahY
W7g7xd0tIi3yja1qDdkvU4zp975/Q/Ls+qW2/4CahlukOj8LX/teiLuaFaHlDYqI
Hv22URBaIQuK+L/f3Ogi+hLbSCWSu4zLYvAWZ2Bl2amfDrC3t46gT9u8uNDhlt9Y
4H10s5kON4nXVwgRRPllRc2IYqK6i0JHvF9xE5OvnYDPRblV54WQjJmAkmrEl4Up
kd5SVqVoNf99MzvWrjiId3oZKUb3bfv+tfMCupjr6ELOg9dOQrXHB1qfrrs2q4s4
ltF3+D5jpqhz09UZW/HEpbdEwvqS0Bb1W7oq5jd/LwL/hhmPVey65k4VfDuZF7gX
Mf7o5/pgbQgIaeRRWJnjBwARAQABiQIlBBgBAgAPAhsMBQJa75o7BQkFp14PAAoJ
EP2fy6PFPO0gjQQQAIgM+dTJlwnZBmgSDgnYOKAV8IKc4JWf0jlmQ/7Nkqpyujb4
oMYDkvLNkKhs0QsiaCowz2IY96RksEUEZRim2L8sXYi17RYxsu6l0Cb54YBpQXZw
gOUPxIJmT4vdoP0cEf6ryo3G7BQ+XqpKOyORRd22/Oplu5DQLzEJZIu+YEptobBY
pUFqM8C9hFviCJW0juDDSdrJjiUnP9sqPXfbXpRZ3GbgUatlFeOOFFqS++rRP5fH
JngxFHqWKd1f4SOP/5ECtb1POGBPT9WT0YLuis6Oqo4yTvk/Oyn3mVNPiSlBkXML
GDUj3L/1rrADtj7HKPkHssR9cWq0MoUwaucSAvJEvdd0WPqG+7tIcO3SvZpkpIhu
L55vW1i9Iog+Vy60VsdgbM0QB1TC2OwRomWCYy9OrPbNk9Uk0oOuvrmc3ni7HpcT
TDm/+ocvtJ35OPwqdA47oxq1lY3dvRrB/6n4XT028PI+Axpga0/4w+oxN9ZESgTk
S0Jf9fuSKCXNWgcWkegKYr4ExEvJMKbx5O8DYJgQbvtmx7XUL/oUrYbpYWlhYx3x
/EvlWIE38p3us/0o8cYjh+gsxAtaBPmsW2KDsu205AMSsjUoF8jnY0eaMTvORQcW
LDc1js0jGKX1KoNRxySa4IwUrN+BSbtIonPw27Uch6NIu9+1CwUkagFOAimUuQIN
BFcpcKEBEADO3laIO69lLMz5yv+71c8cfr1Xjw99ax6JRw5+S+63/EooZzMQAnVu
79e9EDqL4w5qudCTnb5DWARnPY9pSbMvuP6vvNJYmLeiGT4R7pzlxw7oNDfoTknI
XmEOjVSHFg0YFSU0pxv0F35adC5m2YcxEEGOXNNxFZ9m/H8XDA0DsA2hqlxhcKCn
qQ8/aH6gkAUdXfpW+dXac7h6MazsErsMaPssPAvmlMNglOEvRoCtvI6+PB4rCsJL
eBaCj3pu+DaJRSyJyTt2TKKoYVxW6SlRIWn4ysii/P7XMjM4fNUJJOvLBwdEDkJj
eKNiGsz5ahAWrfVQ7aTuvp0h2g3LyY2tYhDeLGY4Tm13eVi58s3oNLcXdgsfMTgE
udA0OwvEdR5Kfgth0thBZUjsUH5xML8t/FpLmKniUE4VdnkatSSZAe+5xqmkn7V3
ZJm1XkhUHFdETVc/xgTF7spccPjzMDkrFqGKmoC9n9ZJDX7K4BhIxMHG6SnLbXVd
4D+9ErRePchem9Q+yo6bBzw8X9nxBeju4pBkpmr3eCF33Atn+bN0ncp2G8BW2h73
aWuXXqMhkCSko4UB3sviuCL9aXkAaqvk5WRBAhsZhEgO7ZEsTz0NTf6BxZJ+l1B/
fNFAL+0awLpDOWsI4Fj4DO/6EXdmwRAmRBsSzv/WvfbJBzRBKZdoZQARAQABiQRE
BBgBAgAPAhsCBQJa75pVBQkFp10xAinBXSAEGQECAAYFAlcpcKEACgkQ9xwiw9sf
cidUWxAAqBuhLpGsfE761pLeO3DLEtUKt/YXFNiS62MSOO3hQYduZihq45Lvc6oI
eFvPGZq3ewHJ/YKI3BeCYJqB3yYWDzd2XQySozMMT1CsJF5AbnQ+VYmICGOQDgVU
LP1YOt5zuYK1MKCwG2sh/1pOJAbZA7Oj8BOU8hz90r7+F/65HMDku6QZnglpb1WT
v3+U/TQcuarYdPd/gqUJogwLfvSRhFcSXav/qpcCHvJqO7iuz+8cGIoply87YKz0
WsipQl8wO5fFpk+T2LIc7vWfs56CIRh4+xI/TJAySwpX7Vm2D1AZtN/myYXrVt2J
N+GyAzUZXU42kOpkIR5ojagSohxdQcX+C821vk0izHxivqkm+Rue/TqdrnYSyoRQ
earNG3ErPRnF3GP3m82IsZEGwM3I2ev8hpQ5wtehXv3VGnfpeqonrVecvMsNrFvl
Zw8OsLKbct3DQug1rIacgb3tXz9oO+VSY8c0vNuaY8gPqyXuoWWht+djgnvueTom
TbaBCIySnzj2qlCkfrMkWOZG7ONhl+HWSRekIWiYirsWhTxEPgNSebXvBdDYhn5Y
a2Cu4glJDhO4ptFX59pKDyDltwFXgc9IfZfkVrVMVx6IwhjrXILZvul01LDeyVOw
8Dcy+epUpJ1012qUb9Capzrq8kXEsb4FdBqOpZ9e3MOWlQONlGgJEP2fy6PFPO0g
TV4P/RY9pjtEMYCQ4i2qPdDXFpaIFv8f0UlAegN9bF32uSWXHLksuo6J+/40vYDt
qPzBO1JQUovKb4Xgn9muN+YDT0u7RyItEQSYczEOjf1ygd354bjvefhfarMboupl
5h1zKR/S9hCQMA6CyyN83ucSPGzuJXaTro5a1IIL8aFJGyRU0wlFmW8csa6w3rtO
u13jSh+XRSXrcGL4/IpTrSVbvqRVF6ptyiLnOPJ1tf2DMUCz7Z3UFm2sXd29seL2
Fq3KwEWbLeMlGlRRVbdUJkVtQqhcG3H1pWTcPbO2nWdNEIsV+DovvaaHp7yg12ok
/8+GY8fwEnfb90+w1Pox5iUlBX47NdYsuX8QEON3fbt2+rTKE2hElIpGOBOjQwF9
Q3r7/tJ8wHJS4TBFzuNOmgLNG1jVuasYEB5NdXQgrYd0ADnAsGHq+L/5tsoA8B/y
OWdlXLdRZGdThgIrJLBy0HCes0vf7BU67wXWOpUzTYVMphStomafGnqMkTjhUUAQ
6KOPGVWBXGhTqNQEWhlHr9Ro+9We0ULbeWt3Ldcnfr9erap8q474jvTW3cbbqAT/
7qS44dDnO07gu76L/UntHgRUM5p+AwIcbwduMDGOZxMK0rNlc3GQm7KDdlJGewAr
HXv4f5B0kS3W42HJYVfByu0jHyyM3Q36LW6hchdGRpKHHlDFiQREBBgBAgAPAhsC
BQJfAiWrBQkJueiFAinBXSAEGQECAAYFAlcpcKEACgkQ9xwiw9sfcidUWxAAqBuh
LpGsfE761pLeO3DLEtUKt/YXFNiS62MSOO3hQYduZihq45Lvc6oIeFvPGZq3ewHJ
/YKI3BeCYJqB3yYWDzd2XQySozMMT1CsJF5AbnQ+VYmICGOQDgVULP1YOt5zuYK1
MKCwG2sh/1pOJAbZA7Oj8BOU8hz90r7+F/65HMDku6QZnglpb1WTv3+U/TQcuarY
dPd/gqUJogwLfvSRhFcSXav/qpcCHvJqO7iuz+8cGIoply87YKz0WsipQl8wO5fF
pk+T2LIc7vWfs56CIRh4+xI/TJAySwpX7Vm2D1AZtN/myYXrVt2JN+GyAzUZXU42
kOpkIR5ojagSohxdQcX+C821vk0izHxivqkm+Rue/TqdrnYSyoRQearNG3ErPRnF
3GP3m82IsZEGwM3I2ev8hpQ5wtehXv3VGnfpeqonrVecvMsNrFvlZw8OsLKbct3D
Qug1rIacgb3tXz9oO+VSY8c0vNuaY8gPqyXuoWWht+djgnvueTomTbaBCIySnzj2
qlCkfrMkWOZG7ONhl+HWSRekIWiYirsWhTxEPgNSebXvBdDYhn5Ya2Cu4glJDhO4
ptFX59pKDyDltwFXgc9IfZfkVrVMVx6IwhjrXILZvul01LDeyVOw8Dcy+epUpJ10
12qUb9Capzrq8kXEsb4FdBqOpZ9e3MOWlQONlGgJEP2fy6PFPO0g6OUP/i7NGgKx
8BcqGwxLnD/0yWAxFIR4hhqyEFMhu3at1x3RAS+Wbp2VVtVBKXEjHF8FU4uumAtV
jnDX7znLNRxU3V5V3D0ISxMtvbqhW1mCMyrbc0o2fwd53klT2E8vE9B+VV6XUYzk
Viqj0YOcQ7mTDbNufPrapdRtT5g/05lC98MBSjzGVv11h9t8dTMcmPBgMMwzdYEJ
tdHHJzfjmvqApYe6mP3NvCO9j8qukVX3nQjxx/5y2E17CyASwU8iLpB1mjPcTKFZ
xQVdg61m7ftwptIdasQaY7msqaW9C44ULMdxMq8E25ebMT1W8pGzLjO5xXI6v1o5
h9hRNJEjPVpODgcBz8V+VZaiyfbF5/Rq/SUhHXLdxLS4ZvdWxoWj3NtbItg42OtG
qOU8CFh6pZQp3j2bvkQMdTQ587QByTE3cev+1RAjrjGNqIpSyAhDrFICP6Wz4EkX
OO43P0SZry7u5/lQRSo9w3r0j29MmGSZrVxgG3WRuzXh7e7Ii8uSETjqtmIXu9xO
9HokXbIcVmqD+eF2hdtx1FpSTvV3iefOn7XVVcyWGQHDfOXtbfyE5McZkX1YZ9gf
vS/3t/c23hqM2rFNVBs+yKfZIGEa7w+WedspQ4RR9PuTJP1El1aPCVheMIKxJHgz
24DIbd7BgGqHkwKf6fItseIGXWNWMFtLhObb
=GEF6
-----END PGP PUBLIC KEY BLOCK-----

Escalation

If there is no response from the authors within 3 days, please escalate your vulnerability report by emailing security@blockstream.com using this PGP key:

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFv/XdQBEAC2iS1uQij2AJSnvQZxScnqf6v0db63QDbS6GjH5PndQ8cF0szv
YJYCFBigkzj4BkKxbJJlnfPW6Jl3SfzCGDvBW3IYuB3S10InDqJFYcM1ZemWCGAs
HA48NDfB4AIBIFH09H4dUE/J6yAdhX/+Qa/bjOhiwrCFVE2pVtMN8aTFnaLzxCP+
fWZUaPrPv84B7uxEdLM77wIhsN+16FAr1qS42NfKDDolBAs//Bmv5fkNC7lzAVCf
MA/QEcNlAvButPrNyZU3t25maUv5hhKUDdJ2G/iACf8tVgp+ygmD8NHQMLPSaFqa
O5wy77Fd5OyX3Gii/E8MtPEsePViwecwJqc/3UXBx7zTRou2gxLikVFTnJb+Jit9
F2kcljhCjHGxsuhf4Zr6zu+RTHHDgdBmpt4t1HA2jft/40r+uWQjL/rNP+01HgZj
4OLHkSI5VfJsXRn1EqOGpBIzR56f0GaxA0jluQMfkE9PTMxg5+YbrGgdot3l7pQ3
+mqMu3aim2EYZZHTsMCRt4j4pRn5g4BZan+w7STfA7rIMJu/MjP3G4s+IFMPVRki
QLwktZSD+x2M9iIsOD4YVheMKtU6WRroFeCkXzIzLYwCuZ4ym/JFJMH+Keuyo254
5hcymw+ivmPP+xuuoP1npQioRH4RKpfDgskABv8+t5rteV4BtUIWL33A/wARAQAB
tDlCbG9ja3N0cmVhbSBTZWN1cml0eSBSZXBvcnRpbmcgPHNlY3VyaXR5QGJsb2Nr
c3RyZWFtLmNvbT6JAk4EEwEKADgWIQQRdlQtqY5x4TNyLvdKyMyIaESi1gUCW/9d
1AIbAwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRBKyMyIaESi1lcQD/9HZmtP
XhKtwC92zTsT5Xqt/K4ckaiJRaUlHeFtfkHpTdXIUFIJjZ1w1JJAWLtRf58MY45U
5DAOOYQptoXiy4USZkIMH1uBtFSAvyCUXH5cDWK1347G5rUg6Ry8Cxe+wzXOlxfr
f/9Vs28z+awfIrvk50sj4QW+mMlS69VwuHUl5CJ+BtcqQWQO85ummQxQq8rMw7rD
AwkftqiMKz+YLw5/xECyiXDDdQr66kdkglbQGgiciS7HNo0SQ2XqTNcGZkRA3lmv
HYCchZpgr9qxfnLjgVddJB+iNTwFZ7AQ7ZBlYWvu5UIMweuEz+yB7WGbQZLOsRZ8
OaIPmZ150VX0sQYeXYhoFrraNW6obFqsSklnQbsfw6KsCaFvYhNZgHf177YlrAzq
puR53H1sOjOQq8pnbjyf4XLhAGMC65LydWtkQK77m46kOBZad9UGg2WKg/SY+3pF
WWdP7vlsR7oJyElEQfUwBsT16K/6kenyagQ6CzqnF/X+W7P1STndpBJp4lD0RfaD
v6UyqxPYhUuQ24jP5jm8+RtS+OGB00czY2cVSDgjYVuU80WsW+Qt0XtLKeoVYdCb
TaKgreicqbz0Afr9hbPIieW2wbQnYlRPjprTVhhGsxlaUb7Kcz7fapliJrKBFgy5
odUljZ+iSompuiYtFhVYA8e6sx0pRUGOopnkGLkCDQRb/13UARAA3WAlRv6DofgG
xu+L2ePZb1OCQTkn4Eq+24veGibPvlqFJivF1ebctUtxiKVsz0dXtWcAYk7Rh2I/
xsEGxIzhjr5VLVOdldM5AgJna6WPvOA4sPXjdy47R71NfEQfg9Svv93mmkpbJsL3
NuHxvpoeO4A9JrFfwn7WJevXOiUWdKJ+nn0ZPwjYle6i27OfIojyVmZVQEiHC/Il
LxQEYaNDalAorjnn0b7X7S3Z8pMAb8HqD0RTXXed9LPgbasARyND2I2xy1txUDPI
Qcq6tIbryGYlegEHuvsE31zRPoNjnXkwABb6qBkUUiZMbRJCYOQXSo7Z2tasKHIJ
I/FnIj8dmT/IXDb9KiWr8wziGLdgnZx3QZGt5P0LIMFKrfXMNJO7EmO1QMbgZFgk
JPhJ0o61PvMaVLMQVoxD6K7bKOzI2t4LTA0l5RxuMcadu8G13YzgVXX44Cac1qUn
xriMzk62HXdSeZozcO/IRN7Kdw2bB++5EVYTQN1EEhIymXVUrBg2pXvLSXalg+kp
0BhLVHcbTI51mKz8GY9NUShFI7ZEzxzzltcEA+F5TLrPMgT+tx+QvjDdGWIhWycI
KW53hjKiGolhpG9Kqo9ogtCO2a3r6JspO0z+54/EF5rS2LI13pqk0qNgoYMYqChe
XU8BJdZ9siCooQ+3o+Y/9TkQWSAwnWkAEQEAAYkCNgQYAQoAIBYhBBF2VC2pjnHh
M3Iu90rIzIhoRKLWBQJb/13UAhsMAAoJEErIzIhoRKLWGhoP/jFfwRrda1RNR6OY
NHOIa4x4PtjDuYwDYgI5X2NQXlglyOTWouKjY1eu7LRoQSS5blD7BA9GHhYRDBL/
0NQo/EQn3JFoitGWs07Bry0A4DTOz0H7wRqVXtN+Ck13QdEemq+suLE+PcbRJ4Ei
ANoNVgSRGqYO683oXEzGgzF+FXXPbcRTNHwvV8LgmUioe2cgHX3Q2PC3gUTmnNkq
IhWirlT5cQVSLS2IzsP903uq8VtHl7lXLkS6Ba3CmwLoHYfhurGQNR6Av2WPgL2D
oY8NOxPdz9QxBUzUVObiMm3UfD/eTF73NAmNJRDqYzpY/l54ZyxLFjlfXRpwKrx/
islwezx+2fzns5u4xwdywVHzvgsmbXMIDdNTaTS8BDaKbAopLmbmuTnnTbJXWFbb
mQ2/GHcB0mKuXDkzt+7JMQ0NHtrGC3qvEtnTXZGXr3uIhFDkJSOoaH68dqq5++pz
GtT+aiv3L120r0pSSyTgbPsrqSlWgXEuJ4uzt3j69J0Qek0YrL0EDxHdnGPW4+fv
AZiq1RFG8MHOy0Obahed5uqlzXCNtroHdgSQeR+6IkODSsEd+hVdXJs/hjcWLNG5
VNztar/H4BSwlhKbgvFivOzhj8x5TNoqMM95G8Ew/5idiT/YQgsA6lcwsEZ78t9O
lTHPj4G8vH5F/zIFb+uQNSlKzuH+
=8mAH
-----END PGP PUBLIC KEY BLOCK-----

Acknowledgement

Your help in maintaining and improving the security of this software is deeply appreciated. When the vulnerability you have reported is patched here and in downstream dependencies, we will publicly disclose it. Let us know if you would like to remain anonymous or would like to be acknowledged. We would be happy to acknowledge your contributions to closing the vulnerability you found in the release notes, source code and/or documentation in this repository.