Please report suspected vulnerabilities privately through GitHub's security-advisory form. Do not open a public issue for an undisclosed vulnerability and do not include wallet seeds, private keys, application-key backups, proof material, or other secrets in a report.

Include the affected release or commit, impact, reproduction conditions, and the smallest safe proof needed to understand the issue. Reports are reviewed on a best-effort basis; this repository does not promise a bounty or response SLA.

Only the current public Mainnet release is in scope. Third-party wallet, STRK20, RPC, Cloudflare, Starknet, and browser vulnerabilities should also be reported to their respective maintainers when appropriate.