Do not open a public issue or pull request for a security vulnerability.
Report it privately through GitHub's private vulnerability reporting: https://github.com/bisoncraft/caribou/security/advisories/new
Include:
- the affected component (CLI, desktop, Android, iOS, companion app) and version or commit
- the affected asset(s), if any
- a description of the impact and steps to reproduce
- a proof of concept, if you have one
Never include real seed phrases, private keys, or passwords in a report.
Please allow time for a fix before disclosing the issue publicly.