We take the security of p2p-path-finder seriously and appreciate responsible disclosure of potential vulnerabilities.
Security fixes are applied to the main branch and backported to released tags when
feasible. Pre-release builds toward 1.0.0-rc receive priority because they stabilise the
API that downstream consumers rely on.
- Email i.pinchuk.work@gmail.com with a clear description of the issue and steps to reproduce it. Please encrypt sensitive details if possible.
- Expect an acknowledgement within 3 business days. If you do not hear back in that window, feel free to send a follow-up message.
- We will provide a remediation plan or request additional information within 10 business days.
- Once a fix is ready we will coordinate a release and credit the reporter unless anonymity is requested.
Please avoid filing public issues or pull requests for unresolved security findings so the broader ecosystem is not exposed before a fix is available.
We can correspond in English or Ukrainian.