Please do not report security issues in public GitHub issues, discussions or pull requests.
Email security@lib.id with:
- the affected repository or deployment, and the version or commit;
- what an attacker can do, and under which conditions;
- steps or a proof of concept that reproduce it.
We will acknowledge your report, keep you informed while we fix it, and credit you when we disclose it, unless you prefer to stay anonymous. Please give us a reasonable time to release a fix before you disclose the issue publicly.
This policy covers this repository, the
libID repositories and the services at lib.id.
Report issues in upstream projects, such as TLSNotary or Noir, to their
maintainers, and tell us as well if libID is affected.