1. Reporting#
Report a vulnerability privately on GitHub. Open the Security tab of the affected repository and select Report a vulnerability:
- libbitcoin-server
- libbitcoin-explorer
- libbitcoin-node
- libbitcoin-network
- libbitcoin-database
- libbitcoin-system
- libbitcoin-build
If you are not sure which library is affected, report it to libbitcoin-build. The report is visible only to you and the maintainers.
Follow responsible (coordinated) disclosure, as described in the OWASP Vulnerability Disclosure Cheat Sheet: do not disclose a vulnerability in a public issue, pull request, chat or mailing list before its advisory is published.
2. What to include#
- The affected component, and its version or commit.
- The platform and build options.
- Steps to reproduce, or a proof of concept.
- The impact as you understand it.
- Any date by which you intend to disclose.
3. Email option#
If you cannot use GitHub, email mienkphi@gmail.com. Encrypt the report
to every key listed in this section, so that each maintainer can read it.
4. Handling#
A maintainer acknowledges the report, confirms the issue and its severity, and works with you on a fix in a private advisory. The advisory is published once a release containing the fix is available, on a date agreed with you. Reporters are credited in the advisory unless they ask not to be.
5. Versions#
Fixes are made to version 4 and its successors. Earlier versions are no longer maintained.
6. Not security#
Bugs without a security impact, build problems and support questions belong in the public issues of the affected repository. If you are not certain that a bug has no security impact, report it privately as a vulnerability.