To report a vulnerability, email security@payjoin.org. If you wish to encrypt your disclosure to you can use one of the maintainer's PGP keys at contrib/release/keys/. Do not open a public issue or pull request for anything security-sensitive.

Additionally you can make disclosures via github's vulnerability reporting.

We follow coordinated disclosure: we will work with you on a fix and agree on a disclosure timeline before details are published.