Do not open a public issue for security vulnerabilities.

Report privately with:

1. A clear description of impact
2. Reproduction steps
3. Affected components/crates
4. Suggested mitigation (if known)

If private reporting infrastructure is unavailable, coordinate directly with maintainers and avoid public disclosure until patched.

Security-sensitive areas include:

• bifrost-core cryptographic flows and nonce lifecycle
• bifrost-codec validation and parsing boundaries
• bifrost-signer authorization/binding/replay controls
• bifrost-router routing/queueing/deduplication controls
• bifrost-bridge-tokio and bifrost-bridge-wasm platform bridge controls
• bifrost-app state persistence and runtime configuration safety

• Acknowledge report receipt as quickly as practical.
• Validate and triage severity.
• Ship fix with regression tests.
• Publish advisory notes after a patch is available.

• Threat model and security model notes: README.md
• Repo architecture and crate boundaries: README.md
• Release security checks: RELEASE.md