Skip to content

Security: jamesdorfman/elements

Security

SECURITY.md

Security Policy

Reporting a Vulnerability

Privately and confidentially send us a description of the vulnerability that you have discovered using an encrypted and authenticated channel. PGP encrypted email is preferred. Our contact information is given below.

In your report, please include as much information as you can, including:

  • a description of the vulnerability and how it could be exploited
  • its potential impact (e.g. privacy leak, denial of service, theft of funds)
  • steps or code for reproducing it
  • a proposed patch for remedying it

Also, provide us with a secure means to contact you with any follow up questions we might have.

Considerations

Please take care not to violate the privacy of users in your report. For example, stack traces or exploit scripts sent to us should never contain private keys or personally identifiable information.

Give us at least one week to investigate the vulnerability you found and up to 90 days to fix it. Also, please give us reasonable advanced notice if at any point you intend to disclose the vulnerability to anyone else.

In general, please investigate and report bugs in a way that makes a reasonable, good faith effort not to be disruptive or harmful to us, this software's users, or the users of dependent projects.

We will take care to inform the maintainers of dependent projects.

How to Contact Us

Steven Roose steven@blockstream.com

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFti1+IBEADCzPHUHyQaSrXWTfFUqBa+KnYM9/dK85RI/KuUBWkTX1chGht6
08JbAp9vnUGhggS5XgMn85nSwrC3x+wsRKnwIFPjqX6n4GbJZKySvC2MWGR5B6oj
r7cA0Bubzl5TjO6vJHKUuUgaHGRkxo7h9hDY0CecfhLUDrkDVFYc6ol1bcA6/t+i
utAnEvUXE5vwhWKJ9bsaQFPkZ3SFsg5gjeI+nxo29WNTkJeEiDGfRlZtqx1ZIDJJ
eYYqNMg65CZdZNYfN6nLGW/bxuM/2bDmPd9sXdDPfefbk+Jq6mhXeo9P5WvE8yzC
65AQAulLfKplFrPgDmAUW41il4ycBvlIR/M+NYE9yTKAnOlwPXSuHdqRJHNaJIe6
inKqSx0q1kpE2qLLN0Gyjb6O+kYEG88D9mMtqPiUKU1OLdUmOZVWMZ579yqpxK08
OrDwOJ0qWZYRU6xjU3CA+SGPrfcPClYlwEMXl4YKj976e8+78Go9pY/JuA1oha4/
W0z0mu83Z2R0TJhKBvZ+13rPuGr4HervaxLKW5fiARG4TLfDUfGGPczMZ4Payik6
u0Ax5V2cNdUT4Q7M3VA745anDH05QoobmvIdWNCsMXK9+JKL7mOf/sF3aS7QS8rq
DjY8QbEj4tBSGi/9Ks1vOWIf0yZUufMyAMZ+oGcbEqUTbOl85tKbjWpX9wARAQAB
tCVTdGV2ZW4gUm9vc2UgPHN0ZXZlbkBzdGV2ZW5yb29zZS5vcmc+iQJRBBMBCAA7
AhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAFiEEjMl02c/QNNzu0hOwKlfgphDX
8ZwFAluhAmcCGQEACgkQKlfgphDX8Zxybg/+PvfWQ7aNWLtlPW2vcFfhyY1RWREa
GPYiq81jVDtRbOmq6hVu6rzhD/jxB4pAqduAVbhtj9opEZPjVBLKvLGzZY5rFQOE
IAcSDyypgeF+Rg9aWmDFepNE2BL2fDrwYBb46kaFGgteeVErTiVORG3InvudfdSj
09zncxo1KHcHk778wJiSvZvNrpCyTX7V+AXgBlwozdlhoGpKzIFpU4WUuPUxLpJy
x/xKCYVq5K8ErGfTNPpCh1GTBIhuxXXwW6+tuhWdrgTS10A+tYmq++Bf0/ROT9kn
lB0zYP47GnKNV0luiQ1elxsIF10jwj57HpefgHFovtk5ZE1zTDoilFrcAVfxiK0U
sBqVqNh7ktC3PEPDZXS9K+Ji65deZxRYccyHLrxANkex8ZJfpbuPUK3AtiVVryfI
DmfEMElraGuwaoOKe4PFZi5/LY9Zj7spQKhxJ6bjxq2wuG+uuHL53Enh/z24uULY
ozwZNI/V6oD630jP6knhyomy54jzw7y3oKdxVMLHCaGHUNpX0lOAvd7bPMbLgBj0
sZKiAKWMGv7zqRqxRCTAHL7ZPBS9aKkMcbHJHX1TbheS2+oKDiPVCqBRlGT9NfOJ
oNVs5i/kU/bJd6ocyNQRMQtICny6DWKc7NfwS3TtKgpoZRelfmatEo+5c1VyL125
BKYpTzwrKO2PmNyJAjMEEAEIAB0WIQQTPqwXlDbxSlzxt5SGD+uATmaTIAUCW6FD
ggAKCRCGD+uATmaTINAfD/9GfEycn6PsfwE62ZyEGIPle7a+zpNw/98kWbqcAven
bPNX4piB4aXo+UfL5esndY/El9YshDN+F3XWphVI4zd5NHB47ApHyHYiDb68qJxa
6BV1fVr3wSqFabZTa83MpRwoq291EBqSxkWexTYcPqa1zlQM400X22lzz41+9eEZ
Vj3ydb3jMM4zJVDpl1mc10ZO0d/7NSFHo9F702jqz6d0gE7qk6BBQsl31Q9ntba8
z+5ljRJLdNWNzeMVgNByvibayTQw5L2mVVj7d43hb3jg70PNpxM8QSCyNP6T/vzE
qqDSRnyHSfVx/R/QdxT4n83xpBIdcl6rH9Nn9SFzjftUv2EfU6CIXw+nqgaiWoAl
ZmxWFClNLEE27esFPMkkhSAiFpHjfOCYod29z7QhuJgrqGtQku2bVUS8WjsEBh9D
ZXhDgm84fkIrkBSesKA8u/RqlcWX7RTEBEbIsTXXCI8krXmr4QhFtt5LGpjhpk6U
2m39f4tPa0Z1N12BYvjRSmIB6hAavIgyqBt8DJVjrG1nsYfZrPDYb4yvDDDu8ISv
uRlOsRMTqqJPI/P44aop2lCPMoBbd+5F2mNWLRMxa3MngmBz3/l/coHGLIxQtonY
tT1y66H//VaiiF8DA4ws5b8tuIjk4lK6rtACexdLsoSgr34fAs8xBs+F0zn7yHyn
n4kCTgQTAQgAOBYhBIzJdNnP0DTc7tITsCpX4KYQ1/GcBQJbYtfiAhsDBQsJCAcC
BhUKCQgLAgQWAgMBAh4BAheAAAoJECpX4KYQ1/GcY/wP/0lj7CIztekzsIzls2bm
pBKtXSIVig1piMAVSH086JlqneL1pZAeuvinxUxRrGg945/M9RQb+r9c42g31MNJ
ukN81ebl5rJvRu7A0euGp8fTnmLFur52oEaVtscILNA5f70+i702X03wUz+JFPsD
hYDREzsp2fWI49hkwmwirw+y41kbc5LYNFXMA7CquNopqymFIbIhgACdlJrC2Omz
TfhU+3ITXCS/kunx9McVE0iFG8ht/iSdhA/HEsRzcqF/+1b94vOiTPTOOY5DZIb8
D7dWlU2dH903uTv293Z4bKEpbPQHiKYsedYkvC+lDP+KPAAVWgWekAieSC+GbzcV
wL/2AvoLlJDuTJeHJ8bEDcK1WVKhAJGUZHS2Ja4kg+/++EIv4iBNbAPDBJI8RUPG
oHXaMNjtQB+heGu/bwoZnRWPSbhZ64ief+cYz7nItK9zgg96nifnXNj7jHYWlF/T
Z37mOVPjEWh5fL1DXqNgKLRyWs3WJGFo0L4SAqlg3m9xNhXr4QTRwPhTZ5z3IN4A
nCxhibupNOqyFfxU4YdwLjjDR0HUOX5WtXKmfoHm97ZQRyeLWvclXfDOQd6RiT1Q
b7iHywmvkORs5aZlEPuvJO9LryJv5zlUXmimoyhxFiAJgG1vT7QeHFFBgXTVJbYc
x7DXhZlw3Fe24g49u66IUXipiQEzBBABCgAdFiEEdICQk3jVROprbc63U1sSmAu4
pNMFAluhz5cACgkQU1sSmAu4pNMMhAf/aZRO8cjjvmWP/s2nbOdINiTKimBttU51
7fJrecpIBiV53qNW9KbeG2gGKXlJ41v3UT5M2vbCtxyBI3HViwsMd0yylMMxX+QU
SDySTma1zvEqm0IN6hFl5XkjBF67eBxxs2QB5YyuEwGI7VAxakjlP+d17XRvmTqg
BOev48cHmSkdhmktHSMdW6rsKPJybxiwGmoQP1j8bsCWY1NocT64lZjxXw5q56X8
8p9oD3tQUP0YUB/0tKMzTykTwOj11/Qkj8MLCACT2kGOTqq/hPfqr21stSSrtxS/
x9cKUdun3f2Qmx2c4eUKOjAFkhOzBuIGVID3/dhVhBLwsVZvyzOecYkCHAQQAQIA
BgUCW6TzewAKCRAAAjQFnLUHFW9ID/wI09/5r2+FkKW4KZfGnpI09P/CIDLgDZDn
2UwjWS+WtSt9YtpmrMgJ3XbgMLp5DpJqJoWYydvr0GkhkhABUo6vTAIfHfCmqBFi
UUGySF2kWfVckowkpaIwCx7mAzEQ2gCt3E9GRGP2i53PIq/bvoi24AuBIEBR0wFo
ex0EQOwC3eDBlvYD1QCZfnPatesZt8wOIrznV6WgTZqYuC98OwLp6rShEE+LSadJ
UeMiReQoubSw63mf5XwNv4IOSg8nOQbzTXG8zmO8cW+57Ko4HFtL2kQJdBs+gEa6
9vbCBSHOJxJs7iJ2AxQxHgGpm6YCBuD/aE9TYInCv/oLPIXPdzAZgNBK+k+wM4/d
9oEAn9t7+SetfbnimOQYeO81nW8cxK1QTciisObpezUn2/vxERchSzMLfWGdTGqY
yfcUH41L7KjN5bnawhaOFOMJBlgBsC5g2eCcgo0glr3iSewD0LZXS02fM+CRPIyV
DjBJJmR7z8JSo+Zmf3YOiSa31s0jJUJeb3S82CHYgGezz39Pl1ewOwHe/2xu/RDO
XLLFuhvPHuzr06qJYNVfzDzVJ+WfPyeQDu3fSNsjoieMtWSkjzwDKVPb87N4Wk8n
rdEKQWJs02gbcZqTV/damitOPJyZdJXAumvnUpsvGdMyzEuJTCCGKGZc+G4pKJLZ
4gF4pZbeHIkBMwQQAQoAHRYhBA5MoSvha+aRVvVAyZhPEMx3Fp/SBQJboz+zAAoJ
EJhPEMx3Fp/S0TwH/igkYK/s7Tuc4hVbWRFoSICSktvCFQk22A5g+OrTKm74vIAF
Y3B4j5la29rC9uFOcvjRnpnf4GxteLdKRNLgmSTjamzxFZmTmMZudViZqOAYm9W4
jqUKCYcKYixEXmP2LHwNw92P1VT8gpUb+7EMD3OKBUOMSzLO/r5BSCG/lahT6iA+
TTuoPe7v3ZQkc7xZKvy1euQ5QGSaGLvjbS+XERTb1C1pJ7x9f0ZV57XRu/4PIF8y
g6ckkN7G38fZgVKbRCxEJ75u9LLjRU7C8K+Co4FmDumKimZAuS7oxb2NbCxf2oag
Z6FBCZ1mnSID44Ie3NqhTdNAdbFUAw7bJF019XGJAjMEEAEKAB0WIQTfKE4pcqD8
kETs3LyI8L7Q0PXgYQUCW6T6QgAKCRCI8L7Q0PXgYSYcEACVQkzKrOwECOg9HDZs
7XFmFAlEu1k7drh5pjMlcVMmhP6bDHT3evzC6iKpUB26B5Z2q1o9TJXqen1ue92n
obbD1OY0SsvXNZkf3zW+nAVu7vldIZIdZDXW5bX/rlBtQFZrIgjWMqF7D/ozVa5V
daycXeTeIivieGSS0/Y7ewQvDSYMECo+ZnpfJP/5uCy1HFX1P2idOouJ6qrrACke
vxp7a83uxL1tQbSIfKlTwIMyBs7+wXXuLMfjr6T4P3KiS/6e5z2w32lv+tjXL8k2
UEJLd6jBozypZI7zYwGwe9bMZy+lotPVqvAiDPF5fJ/L3h8amM20OrCL0Uuj7uNF
HQ2YFmbu+D8s58VVufy2tJ5xNFngA2ojK6QJhOlpNUXqeZ9dPCz+lxdacTcSKclF
4u8m23T9FTOR22C+EH6O+M/oPHWrgmy1mUwRa4QZZw98cmKTpZHqT1jlFzVmpTLz
k44W5GAX2ViCd+uUCO5m0UKRGQ1aEccBXmxtrupXp+iomHM/kE7MLS5uzl74OiAp
Vj/yFAO6Djrd0cEf0eV433UP1aFIcbmOvA9vScItXb1ODZTASzQEfvVYZOPLo7ml
HpYpFczcj4UjRbns5lBESUT/6T3ihLsIgRtLqW+Ibh5g0YMrY5xlyJnicsviSykl
/XqdjbaugXLQ0gGSjw3VAxLY24kCHAQQAQoABgUCW6eZjgAKCRCibW2f4IjtWEbG
D/9IoLXL5FmfR6svzUwykKjEIHfHSZxlXs3/F+Cq7wiRJIYNUUcN9T47UpkXJW+1
75yR9iIb8VVl5AVWlI2JVkpHCz4Ii5/qsYEPPT/Hx9wGlkloNRLoA0tfcIkHBZxC
Z+34mQJ1mWclQSIMlazLVtQej0xrMZ6EdclQEVuIDCS/dXpwWKEqeCP7DabzjHgP
0kuxMm5F5RxaTZR7DCA9dNbhCw34X4wHyaAZ16Ypt2vyhR80CCQge1ej/LKyuQIa
p6suZSzarChTGvv1q3++OXjvQDCbm6Ywui2ulVaTJUkTaUIj9cvikv0qwgO165Tv
PWVI/JTzvUm+erDI+bH2qsIk8Z3MH2OjlVm30LCf12DHeK4hEmNNXCvPUtWIAlmn
xkyxNghbDZ/bq3CAOIYvFNQKWrYtWc+JXVpQ4cFEbCmJk+Dqf+yVA+/shfzioTl/
F0x+JMKM+Hx8LAAUeD/cnQCZG3H0oFCSTNP4L+ALxmXutShXSXYY51KoiCBZjsnJ
RTRMFco+GSDELBRHihFkG3G/8Wk7kTXledc37oY5h6TuXr4o5DgZE1JLEqpp/nJ7
n2CkFwzsgBHmnYiruHrly9IpIg0VakBfyN+RmbLJdupTG4ayotQ2n2jGAXnzs4A7
C+dxIZMFObx6YxtqG2SfqIpeaZmAuemURq2gIRVZM0HjA4kCMwQQAQgAHRYhBA16
8pzJJu8zWWtbfoZMTQkQtDDXBQJbrJdcAAoJEIZMTQkQtDDX8N4P/2t903CXXG8T
SS+TM3DIWWYoDX3qktV3Ootjkpp0bTyOno4mqmCEeMju83zc+Hq6MmXSpECFTzi0
YaMn84ncxy2d4w+I8tnR7s4prGPPRICX9WsynoN+6PVmGWJ+V0Sln/W0cRmIr5vQ
tFls5MpnuY1n5DxzNtbpFHP0sXc6G9+jYFDQfIJHouNz1jV/kU4GDe5DbaUCltNY
a+xTmj4YBhwrpIN/i1QcczT5+w9iL8KoGQbYjBGWvqyih0OgmRaUelaAipQ1Z/9K
mCKmop7rfnolcrhFlz9O+Qzbwq4XN/2889MqBId2NodotxaBn69YFhEOueiCyQem
xeKwAMPsjM277y5hbBAwG6EWfvZUYFIP5byxYx9qbulORnFENd8EYFZHP6ztyXMt
ymcADbecbFrw3Jzw1Eu9NOYw0if1zETxYpY43NaV4KkBoIZX/klAaeAS5gcpbgPR
QjDgMeKBPk9oesHWYz/iKgdC8KDQmy8WIvV1GkYkbVcDGXNMYHT+D1/uJF3kbNaw
pXU8ymp2gZYivJ/QO8pCovzQokdNNr1YrzcQ2X494fdehxRBnnxArvvslmw/bjGv
ijTgNAG1LTWiYFJ7aU+dOh3c2thHLHIw1TZ8laHgPpnZUKp7x1inZazZVPD5mIPC
Dz+jmcnSVAAUG/ZO6CAcMC+L3bbmdIe8iQIzBBABCgAdFiEE0dvyxLlvLev0wWZU
QQEIES5+qB8FAlz6eTIACgkQQQEIES5+qB+CKg//bFTyVXLhumJDc0vmLooSN4h3
DLUs8Hwi676nyywtNckkg5j4zXBdPhbTswUjMhgZbTLrZVzFRCFam3OO1Sv19Wl+
1Ic1ROZanaBWbvybiBaI7Bsc5IW7dByLrOwiFDuiSGLhgwFc/qMgJLI0lvnO31W6
GlxEvFRjugLQJ8KYeJwVNXbosF1SbNf7eUZacF7pzSedWSjIT02R1UwZCvgqEYxR
qsHBhTSWT45B4kqRpl7eEk2IN4gXw+jzqT9PWI5gLMx5sTKTgiR5YtuIP0ZwsIyF
3x6qmf8mE7ZnRvYNPpis2zf4cb3lcK1NRd7tO/xq1VSQ+SdTq0zqHTN9d2VQxMjA
gF+akH7oRo5wE8CVaz4us2ILtfoeQ98xl5Rp/n7x6r/iLFnoofd6ClQ48HGfK05o
IIiTjb2gvyTYfbWKKENxzrRhmBd5cDRPlRVx23REJQUgWBzSVXmMtMqnmsIptLSG
k146uT96ljTxIlkaLBpKgElK5jac4A0Iphk5zYwSOjVsABTetdCg1Vc5xj3fhj2U
7irxAqFTV6/Qz9dJIwJuO3r0DcB2u55DEjOliaQVkhyzDXXOzIZXBBLp52DKQEU2
NTFK1gwA3GAk14/tRZ9wYKLTHMhCNOGaV0Pv0z21gL+SdTTrAvHw1aOD1HSSE5PC
Y2LKlgCKeWICT2jq2zK0KVN0ZXZlbiBSb29zZSAoSmFiYmVyKSA8c3RldmVuQGtv
bnVyby5uZXQ+iQJOBBMBCAA4FiEEjMl02c/QNNzu0hOwKlfgphDX8ZwFAlug/KYC
GwMFCwkIBwIGFQoJCAsCBBYCAwECHgECF4AACgkQKlfgphDX8Zz/YA//T67rB6kj
Wf8JxBnfdAtVlE7CBjxtRXgLYj7GltkgNfNG+ud/HLpIENSHXrdTfqAw25n5GU0G
mOnu3wCjB5i2bJ3hSF1ApKKBv3zmE3b2saMvnuZ9Gfz0AT9Te5fRaTwxxpot6i3/
8OV4bz7E6Yz5Dp1YnqGCVwktP0OBg0mkNoNmf7JA4BdJ3+XxJVdbotPCh4YAYgKt
IaCK4vqwbP/+yX7geN3TPQh/ITI9hUJM59q2RYF6O7bF1dlfCljbSZ0c2McJgf8k
LS1zALpFBYQHfIXmTJXXyqwY87yJmdcBwnpgB3EVc0Yv9ouHv4b+62vprB3anNVE
svKDQJqlNTHyELAGZanlSUUQlylXl5ODsfZic12e5BT6fVMsKeKCwonRYVudn7Nn
L5AEhz22hXbBVU60IIomKxQhxFS9k066Sso8QVkroXXTbuf2gdWxC53Z0aM7zYlb
hM4i/7pmr7y/dKV73/yLmiLdyBNjFs7KrdB22/9ocMXir3m3/PYQvoFusQmvDd5Q
pwaWIkLebG9vg0Qu9fHPTcpjoMIwUAKV7Ws+RdmMdFF5XHlVE1LP9voNqjX5ETJm
9uv+OTJfnZjwc8Vg+wkWqRupZXSP7jOsn0CKjOn7YTC4iCvK1eruiezKkvvn/y+Q
tAxy+bJ4LVsKe/MRqYl2N0/iCCS7PDhyG6OJATMEEAEKAB0WIQR0gJCTeNVE6mtt
zrdTWxKYC7ik0wUCW6HPlwAKCRBTWxKYC7ik03knB/4iIUD3qT7vE6EzOKrFdAMX
AKqbOF8bUiBmoFBzrsRXAp08JEBqUXTeC0YokjhVFHCT3A0QEOU8a46C5TxRyiFb
i4E+5l/Tm26b6bbDjVZvw77j+U2tOLBEV8dEL6SYQYjS2nMvidR2mzpPqyeM1/xe
sBpe7EhXpPijaJHFENdp/KmXSzmc0mqvpet2yvSGKGMWEl8uNrPVQpeSE63ZJQes
6hlhfjOpxouwtLVaoSEbAzu8ZJgnJwxRGICpCX5uOTngDq4gzmcw5dbz2n30gDco
hEJ7CTs/R0qXNad03L3etVQT/dEXcbKFZ+lyf/Z48yn2uSkPvU7TRnyIWjdAZw7Z
iQIcBBABCgAGBQJbp5mOAAoJEKJtbZ/giO1YGGEQAIbiEFF3Elv1abfrWEPrPVX4
kiXuZVG+8yJz7S0AD4Ron7nOt+z8vtNMFNIW3l/5Efx2d6h2LdZValxFc9bOkaYg
Q3xvQtJU+ZmGv2yW86farRb2l8p4IAo3W9tgf5ixn5RgsYkdGlFjlY7oJUAdXqjy
qklMj5DDSeCGH2v4DjVHBh6wj1XX5pRlQ/oGvWSDAnh4uXS1pL3Syb9kOK1Vix3P
LOGfCaLoFDWYyjsr0KW3B9KY0apJziwbMjZTAPcM0HlRhUz8wN+G+b31CmkwjvGW
czIjyEmcj+nQp+qgakdhYhS14Q2q2KqKn5mxtNI3NpTcLZ0dUE/XGIbIbvnkEQoe
B+XFydId1y/TvOoa8HJ+v+8cXtLy8B31py8SGcQ/zQbRb7xjNnS/HkEIqG8AdEqH
ekCb4SlRmUyeuU52XbC8qiNDUEgy+U06AY9sYiMLY4hcDq4UuQoV5ZPBx3v3EEun
yU9UU0kG+nvokTd38/NMmq0Gx6kB+aS5ErbI0bmd/6u5xX6RGcHqviemlQLverzu
IgY6GDJG5WQkaoO2akrz5DAJzHxCUkzeUaOf/54URb8DbD76eoA5siigmujF5k3m
ig5W5WqXMye9+9R29XiDNfvQuSpvg+hdIUTH/6DtkM7ChN9myBUDZTlqoql5XqQn
uyI/0iNsha1V5TKTFWy/iQIzBBABCAAdFiEEDXrynMkm7zNZa1t+hkxNCRC0MNcF
Alusl1wACgkQhkxNCRC0MNe5jxAAvmYIVj8g1PDb7rNCN1BrWmnyKAP014Gd/zII
Ws5C6myGas+KGRm7qVihbiaEtSwrZ02RZvOiD/xNqejy4KQYsvH50PGKXOf82jtx
8NyOSmc5V+dD3swVjvyQhdXwwKCQdtD4cyBaCeMBqIJhRs67h0QFSVX82lgLCZrD
3A8UY6CVM4xd7iH4LXadfSEuM1aUGc3Lc1iWJAX0FAjhZ/3VrDx6ZkiRh4x8NbqS
kdTa9yoEyQg8ZhTViEXTfk7V0W9EE/PTCMBq4/D2bgDcn2uA+ZrSzrZr4GL4OAyK
mQr/Bes9anZi4YqsWJaK5lGhyDXCxbRUBljE/BQlF5UkGDCIfsZXjJrzeF9p9sEo
a8gxRDFH0PXHFdgCS7NQbReKxhbwB64oYSIpPG9kMTtyQy4QPLX79PwXKtvUzT/+
k5fMVJ+y7qtqcrn6AWBcVMYcv+wZECr3Vimg+f75MOKH+94L9m6vzWCBh7PUSD8q
bqJ2RwPUGML8mje8AXyOWnq08uadr+fJ3wsdGLJ1BQKqDXEP3v+dYamdeIyC8ejv
LCi1E7ZjY2JFWzv0FpZ+iXLwj0m1+ziJZ3x5NLo0uWOrz4qUcJ5JXwEDD5+KwMBA
Pqnv1M9FRf/1GXtzS//UcsV5FTcXFmsfYfJjekHygReGBWDJ/vE/E+DI+h2l8Opz
R4sp88qJAjMEEAEKAB0WIQTR2/LEuW8t6/TBZlRBAQgRLn6oHwUCXPp5MwAKCRBB
AQgRLn6oH7mSD/9yuNZAYtjtml4AK9mcB4QW1JR+CEYSbaT1uJheBr6roMUIi/hx
HTD0oULGryeZSf/9G1VcX8OTMCYHKRQXZw1BkEZkOlsqbT8x58e7REQNd6UGBh9r
/uDSiivcYyqkPwCjTPLNW4F3yp91K7w/q14+crvyJ1+D4AYCkRE9lg6tu4FxT6tf
8HEwmkbuYrHubAv0vPM59yHzSU8EirsrdKBI/b6Gp2XN5Te0YRFj6DsVd6AIlG6Y
YWQY3P/oi+Wk1nTGmPRZxY65pgiVTT3FUi5QtKhdbkciUcozN5oXajALAlJSimfu
KQT93l+lgVpk69RXS19ihUPc9MxvLd/WO0mRLsbHAoASwTJsYW7S8w/Ko+t4EEgA
54gNltOnLScCMWxoLN5joV1jpzKhGM3rfzVCg5o55sfCSht6rhauNCKDjX2exuWy
SMfQqdQqcYggL2ecJd18vBExKrUGL1Ni/JidXw8a3k7TPAFEgRZwh9JQ8A6qijyc
DpahjakfeAhEWnzW91m00WxeW9ZsB5ZF1msZjPSMYS8+Vm8DtRHl2GWTZAQsSVMQ
DKMMgBsiglS8/ZDy+L3kkX6w3eDgQJYJpwfb8vUH2ZvZXk6AYtvPeyIYLWxlZ5o3
uUK1N7A91DCMoOeRNptMWMmDpkzc0MzWpv6Rz3znf6IrP7zVJIJDa/zeq7kCDQRb
YtfiARAArR/OQpdpMW23gGoB8crhjbtkRwTvNNgeLCbS9S4xbJgbCp6yHlFBlx8b
NMbzP4/Owp+2qRzn1FT7o5dkbbiM6CzNFP4l1c+Y25+FmU8TiktvHC2M7Z5BQxKd
K6tv6MTl1qu9VRROl7kbnIrdgIO0Opkz/1YtEfAMInoiXcxO1yeAxZDNKSrIXD4p
HQINjMc82TRnXiFe/2nck+T1Z2trkOHO6xCDa9k3wTfZ56cNTkT5qFUvec3fT1Yn
BZ3ksTnERtUrRgZ1HNv9lgdIWz5dgYjdWEXgk1CmuVGfBSsaVATYbSvwJeuTkeGf
4EKg9sGgIwyx6WtxplIF4orIESFTrVqHGRROXlL8FNlhZTmgUvMBA+7eKDhHMjno
rCMtoawKapSeOC3JsFfZHGnMiRJMRd6aYBnP1qSmjtwkNWNYx704SWSskXZl7dXb
tuXqVnhmrBHdxbx1DdWd4tp4qkqiDn0/FhEZq5bu50XVOTMr9Od7CrO2eXp0j6/q
WH7GdIKmPJG+qfe8tiUjmbOlzOYq/SfSkx5lHZ97KzakbHrLqfPwxIjpUlFHN+43
3WifIxFRm0n4uZ53COTn+8PtYW4MEBfADeGmHQn2t4ehg+B1pBWC71BhdfHklJCt
GiiIdpP+l1MLc7KNWefCpZnaFtal1YMKA+MXfMvArA5Qu7gEA7kAEQEAAYkCNgQY
AQgAIBYhBIzJdNnP0DTc7tITsCpX4KYQ1/GcBQJbYtfiAhsMAAoJECpX4KYQ1/Gc
C88P/j3HdbRHXnFuwIXpUKdk4JUZjQ1G8ruHENwOKUQ+4TbPH+wLJar8S93SpGnK
Jp9tiuahORWqxvUc6CN/6E95zN22ER3cEOc3ANzmY3hYbY6YPB6TzleJh0vn/T96
PoabHoMo1YWP1sTACOc90HYwjQRvpZ3AVnVVWhK21UPllxeYbZhqcPLaIp6EzZ8l
U8EVwl0hZ9odB6gpXB43HrrzDtZxgEjEJSTE/kSjRMtVuXsg8o0Ga3FOu4BgBRa+
GWxfqxKIAVOzgeUEPLi+vjBQvxwS0XPljpt2jsP2oIlIthARtTVQEFLJ0B+fijyy
xBu1GSRijBYEKKBvqWg9N6XmGEMpIlV55DKVGWtdSDOoyAY2tKWhBROGDgFCudxX
MU2ue/QW8dNX66OI6+nDueAhQqANLiyl+TTm/ezvNy0ccpk6/KCOKdzf+cWwy2hT
I5bk+35fEcPa0G7EtkPVIF7hwrAmsJSpctwU+aXXgB4dx/0XViDwfh0n/PkIVSL2
AM778whVNwQ6yCTBGcEvPAFnmHhCNG5x26dTkn7rmu8CmTvX2aMPy69Y1fP9bI0j
5ZW/7ozByF46Ba8pDa1TkbMlCyfAu42usifz1HITe0XjLwWaaWMYLbLYyThavBBI
6Ah5XDfis0CwhamQXQhy+iQjPb0uGo8/tkhFs5sjulkx+ULTuQENBFvEs/4BCAD6
1MrqsoKbLGWO7WzI/PhHaPUBw4X521ADRlFq5VHY62qwwpNDcpjWfDD0+9reIjIH
8tk2KbMnlOW0NlH3DD7adTxB+oSVjSebQvjEt5eQA6gqwx3XCRXAVwf8GQp1t7vw
tI0LUMTrDFeWgAHwHEKUvr5IEmLYt8fwWjzIezryTLdqVqjezFkKOWKCa9DuAuIV
ULrCFaJWV7u8kkhuyzMJutjdVLrjQfn4O7ZZL4CQUp016NOqxmZE0/dJMEK3AxY4
uiPO6ocIyGyjuB0zI/SIaB0BrwpyLgCQZX5x2j0KY0NIc2AXdBwgqpRUO4adhU9U
jNpz0+D7mgTZc6wQVXwhABEBAAGJA3IEGAEIACYWIQSMyXTZz9A03O7SE7AqV+Cm
ENfxnAUCW8Sz/gIbAgUJCWYBgAFACRAqV+CmENfxnMB0IAQZAQgAHRYhBIV1jbzw
Wkik3p6qEn/JE4C7TOgABQJbxLP+AAoJEH/JE4C7TOgAD+gIAJZnoxRBdp0F+AvB
1vOvamN40tc2ZqIi/U7y142LYYY07sMTkCftQuqqBZHfooV1J3pf0YCFyMH/5wLz
5NoQn9pdx6FL5QoIoOma1lTA75k4kVdLi/zQ7eJk8tnudFkAXkKget2RRPMBvWMs
sC8l7jehU2SD9UThMXovmTdYwm96/FGFFTrPY3I+aYwivOl3wJA0qUgGN57Z9mYj
I+Z5SgpnipKkzeVyi98aSfVsLsf93oKo75FnpoWUADUkV4HnBO57vnN3qOw1ZZuz
sRMNEXNWGA1eFOaK/OUWDfkqWZklaVliV0Sk1kSVKs68IUEG/EuslVihu7SHZfmU
vutFP3nwHhAAqRhK0TPiYNf0VNlhM9YAoRXur8zVyil3nsnVooRU2IXSgctw1eRb
CXyJm8mShRs5cQHj0KJcNXmXN23an86bMyS9g8ag1Cx5cN12u7t4uJFxwqyEmqXa
F6sjcGoqp1VgtJOM8iojS/UEjjSqUHZ3UF5Ipxu/qj4XBQ9icntco5SXNVM5MRti
AmadZm1o4HibPcEe0/kjk16dFHsZHPulymgg4Ii8d/XS1jUSpLrccQnz/hKukmAX
49t7wX8lvB/x4PY8LhoBDNhQanQMmkaogFb9oaKAWd2jDBCgpwF3DIZNYPnfb+iF
C3yGIEDwlvX7R1MZxvIhb3U2AVmcUppCk9WoQp1kyV55DE2/m6EnttzAytdfe76x
OxWqPPOF6cnfqSybsgpeHYXDVcxQpkWJt/D74/vaqror5636g9rqYLkorh+/WTOT
aj1MVX9zkXnvMKMpFtT5hWyCA1xtrsOnOfCoVqvNWCnVxxCEHUaR2vBHccVWZEKi
F8ncW/AYVCO3vkHtg4l0I9UlRxz7kO7cFPsr1kFbl4tQeg+ajEeLTHCI36J9O7P8
ofeEbqLPaKjECcFuZWGpafzFBkl7n00ScUQtXc5FxD04XaG41+TMTBhZHxI7G0lK
QeaLxvVyrO5NSamQEu+0/zVrw2uUvLAXNKbtZYdIyYllq55C+kaFVTG5Ag0EXMLn
8wEQAKtHYiKVTdS29HgFjqyqybPl230XvoVkOHWCWeXyIovH0RzAhT+Stf8gJi8x
EMk7rGws9f8S+2q5iGwCuFFJKBMPaueH6deM9uHbdXWmYVl6Q0tyvpDROMXztFWu
X1Sl1KEIQKvolvDGbk1Pcymd17yS4es8O5Y6iTKfD3zdlp4wZguZI5jJS3qAzepH
I8Z/UUjgFU9BAsBnNzQnmfUtiHy7MX3P2GYnOFkcON9Co99bVwHZOYYYys9yXRWy
A9HQx/ioY8OD0shCm3emlmf7Ny4x+I+sG1OfHeFyrgAaXunbAq/66L58Pb1uu0wj
MU2hMhMWW8AhLVhxZKvI9VMO613wtKAvkhvIQPx+F/NUxDfYkyVnPQwUti4l5NqA
oHJ9LgDkFbSvyKZN4k1TQsft5kH0C05r4qTBvojRdnn1ketnA0eG/ACGop87y3d8
7VpPxgsvXIxulCK8SHxGHak4o7DZA1dIg3mTw9ojrCGKHAwadxXXCfmKc4lj0jZj
Yetp/9j+T4+QkWxILlhJ0SWSTuCxmSM4ksrvQ/K6zZSs7iyfAjCkhLHD6vIgRxXJ
eE0x8ozLo8VS1Wrg9kJcHQ1zAZhcYsP6IRFmJ051Dd/fmehTJkz3iu3wszvrX2tH
8mM2YOUTFaiX2/KBZ3dhWo7Oc98edfQtv+y1d7+z9a0ukP31ABEBAAGJBGwEGAEI
ACAWIQSMyXTZz9A03O7SE7AqV+CmENfxnAUCXMLn8wIbLgJACRAqV+CmENfxnMF0
IAQZAQgAHRYhBN4Q6CYpqMrVW3ALly8qiNf41o6HBQJcwufzAAoJEC8qiNf41o6H
fDMP/iW4Kczjf4e2QcwkuhWtdFPREOdFmQ0gu2zwwETKEuyvnawXZCD3/1ne0Pw4
01kRH3QUJu85/pHXSyLhDqPV6n2rsnJI+MFDww4vElU75W/L7j9bKLMa9Opj+EBd
vwKNwMLppSekk9yS8qU/06Aci46+n5hlwP3imQkMTNk2k5gxLHzNDD8PXtRFFF/+
j22dlr7KarFvVtTLnnWlWSqS5wkLXSMTIDCXYQbZ4QvbIOyBZXEGkRGjagDOXu/G
LXxEvXn8mtqYW1Gs2dZ1pExwD24S5n43hR0j2rn4a6bCH41+r+W8t4zkAdIX+OFJ
TnXsyYZGF5AcMGuY2RtdmWyhz//hXAM8vzlHiGsr1oJ/RgzmQaJ/SiluE13KlU71
cfDBBmfqFg+9K08n+f6xnuklxpx0ZriB5U013Sksvj4d/uEMrABdhmrLfeiI8aWc
LHniCNzm5/EnAykBrEiyr3GEuXFXpJCnOsnGsLOm0gbq4th9iyAvJzrGRxF0uz5F
uRvwHYpGyIUzJdujS2X4vEBlv3W+s3zdNo0HeLSVRp9Uto4j/3rdl2wX/VD/6DBQ
igIRbgLzWf9+N2qo8WR7XIC+H2l/x4Truya7w7V8QS8SEM/x0RIfPgEnln2DAVax
d97wznTGrIkDwBSoBPe1T5WVN2lgZJN+azjJMubq+DeSvR2fnYEP+wXzQlbkpHEj
3Td41LRNwuVsRkjQZcCz3/BkUo/UtJVrnpidG44wi1MHn03Lp9GylUvBbmNQkNEg
rRNxSlokwqcYlfcSCpXVeK4kCmCY6cZTgD0fpnC+4VpklWnQFaOWJt+gWV0nUQKQ
aPXMDwQRC2h0GiAqiAJGoH9mehqXyrL1X/zf30l/OgxZhUOy96yM98r+EkeCa6tZ
tNbMozRS4wPrzVogaC/XxnvjOZzGDEDxZ4kjWqKjmD8XqVhDYPPbZ7WovUdHopjf
kXJQGyqR5OWvLKiOtk+uMCmtxbZwqJRfYZziminT7Oh7arAtXFNgpnIEUOu5mTG/
szEKla4wo2/7HNh57/lPoYEolXHEDmXqkTc5mD8z40CYwtbraQI7iwQpqfYX5pKf
NBKN2EtParrxxdgZFVL4HQswAuY9Pq07l7y1ScK2cUZ5J8TeHlRLIsUJNMmCeQZ5
f0O1nV6jpxMcpDUtrgSks7VtHCwcOAgx2mboqTf9c4kF6NkSNBErSYwdVlxjRQAF
7JW/yDcmygvTwyCU7+80E5/2Z1oqH87CXB2Wam9uATAjgfqk3tH6z5hNcefPQdu4
OTFrxjWb3sQbaJKZFVTcTZVa+fR7+hdJGnemxrHegTmdMw5ot5lqOhowTzpjejIW
W5zENLshru7sd+PHfNyyje1/ht9FXbSw
=ixns
-----END PGP PUBLIC KEY BLOCK-----

Escalation

If there is no response from the authors within 3 days, please escalate your vulnerability report by emailing security@blockstream.com using this PGP key:

Reporting a Vulnerability

To report security issues send an email to security@bitcoincore.org (not for support).

The following keys may be used to communicate sensitive information to developers:

Name Fingerprint
Wladimir van der Laan 71A3 B167 3540 5025 D447 E8F2 7481 0B01 2346 C9A6
Jonas Schnelli 32EE 5C4C 3FA1 5CCA DB46 ABE5 29D4 BCB6 416F 53EC
Pieter Wuille 133E AC17 9436 F14A 5CF1 B794 860F EB80 4E66 9320

You can import a key by running the following command with that individual’s fingerprint: gpg --recv-keys "<fingerprint>" Ensure that you put quotes around fingerprints containing spaces.

There aren’t any published security advisories