Security Reporting

Report exploitable vulnerabilities privately. Public architectural criticism, non-sensitive counterexamples and interoperability failures can be reported openly.

Include

• Exact release/tag and commit.
• Affected component/path.
• Preconditions and minimal reproduction.
• Expected vs actual behavior.
• Security impact and authority/evidence boundary affected.
• Relevant sanitized logs/hashes.

Do not include

Private keys, recovery secrets, credentials, unredacted personal/business data or production backups.

Priority areas

Authority escalation, signature/canonicalization ambiguity, recovery bypass, provider capture, evidence substitution, rights/settlement authorization errors and BTDU mutation/reconstruction integrity are high-value review targets.