Security fixes are applied to the latest published release line.
| Version | Supported |
|---|---|
| 0.12.x | Yes |
| Earlier releases | No |
Pre-release software may change quickly, but reports affecting a published pre-release are still welcome.
Email security@vapinetwork.ai with a description, affected versions, reproduction steps or proof of concept, and the impact you believe is possible. Do not open a public issue or discussion for an unpatched vulnerability. Please remove private keys, credentials, wallet files, and personal data from reports.
We will acknowledge the report when it has been received and will coordinate validation, remediation, and disclosure with the reporter. Response and fix timelines depend on severity and complexity. This project does not promise a bug bounty or payment for reports.
Particularly useful reports include key or passphrase exposure, signing without policy approval, spend-policy bypasses, unsafe destination handling, dependency or bundle substitution, and leakage of local receipt or wallet data.
Reports about the hosted vAPI Registry may be sent to the same address. Issues that require social engineering, denial of service against third parties, or accessing another person's funds or data are not acceptable testing methods.