Security fixes support the latest master branch and most recent release. Older releases may not receive patches.

Do not open a public issue. Use Report a vulnerability on the repository's GitHub Security tab to report privately through Security Advisories.

Include the issue, affected components or configuration, reproduction steps where possible, and potential impact on funds, state, availability, or integrity. Avoid public disclosure until we have acknowledged and addressed the report.

This policy covers validator runtime behavior, consensus and state handling, RPC and APIs, configuration, and on-disk formats and migrations.

We aim to acknowledge reports within a few business days, assess severity and impact promptly, and coordinate disclosure when appropriate.