How to report protocol vulnerabilities? #276

New issue

Open

opened 2025-07-25 16:26:34 +00:00 by conduition · 3 comments

conduition commented

2025-07-25 16:26:34 +00:00

(Migrated from github.com)

See title.

I may have found a protocol level vulnerability in cashu with high severity, affecting most existing wallets. I found no responsible disclosure policy documents in this repo, nor in nutshell or cashu.me, so i'm not sure what to do with this information.

Where would Cashu devs congregate to patch security vulnerabilities?

See title. I _may_ have found a protocol level vulnerability in cashu with high severity, affecting most existing wallets. I found no responsible disclosure policy documents in this repo, nor in nutshell or cashu.me, so i'm not sure what to do with this information. Where would Cashu devs congregate to patch security vulnerabilities?

👀 1

callebtc commented

2025-07-26 00:21:28 +00:00

(Migrated from github.com)

Hi, I'll find a way to contact you.

gandlafbtc commented

2025-07-26 04:55:42 +00:00

(Migrated from github.com)

@callebtc IMO it would be good to add a disclosure policy in the readme, or somewhere in the nuts repo

👍 2

conduition commented

2025-07-27 03:59:55 +00:00