How to report a vulnerability in Ledova, and what is in scope.

CI fails on a new production advisory. The dependency-advisory gate says which commands run the npm and pip-audit checks and when; Dependabot's configuration remains separate from them.

The gate accepts only the fixed package and advisory pairs below. A different package, a new advisory ID, a critical npm finding, an audit tool failure or missing or malformed output fails the check. It does not add exceptions from the current audit result.

The npm exceptions apply to mobile/ only; the root, site/ and contracts/ audits must stay completely clean. They preserve the findings accepted on 5 October 2026. Most belong to the Expo and Metro developer toolchain, whose SDK upgrade remains separate work. elliptic and a second uuid ancestry also reach the experimental testnet chain. The earlier toolchain and testnet risk acceptance does not authorise additional advisories in those categories.

The backend exception is the exact pair pytest / PYSEC-2026-1845. bitcoin-message-tool declares pytest as a runtime dependency, but the application never imports it and the advisory needs it to be running. This preserves the existing accepted exception without adding an unimported package to production requirements.

Every accepted exception must be revisited before any mainnet or store-distributed build.

Report vulnerabilities privately through GitHub's private vulnerability reporting for this repository. Do not open a public issue for a security problem.

You should receive an acknowledgement within a few days. This is a spare-time source-available project, so please allow a reasonable window for a fix before any public disclosure.

Ledova is an experimental, unaudited reference implementation intended for local and public-testnet use only. It is not operated as a hosted service, and it makes no production-security or compliance claims.

Known open security work is tracked publicly in the issues labeled hardening. Reports that duplicate an item already listed there are still welcome, but will likely be folded into the existing issue rather than fixed immediately.

• Vulnerabilities in third-party dependencies without a demonstrated impact on this codebase. Please report those upstream.
• Findings that only apply when the software is deployed contrary to its documented testnet-only, non-production intent.