Report a Nullark vulnerability

Do not open a public issue for a flaw that could move funds, expose note material, bypass proof verification, replay authorization, or expand relayer authority.

Private reporting channel

Verified private reporting endpoint: pending. Repository policy requires private handling while the project verifies an email address, intake form, or GitHub private-vulnerability-reporting route.

Use only a private maintainer channel you have independently verified. Do not trust contact details supplied only by a reply, direct message, search result, or copied document.

Report structure

Keep the first report narrow enough to triage without live exploitation:

Title:
Affected component and source path:
Observed source revision or runtime:
Chain and contract, if relevant:
Preconditions:
Security invariant violated:
Impact:
Minimal reproduction:
Expected behavior:
Observed behavior:
Suggested defensive test:
Secret or live-data handling needs:

Prefer a defensive reproduction against local fixtures. If a public transaction is relevant, include only its hash after checking that disclosure is safe.

Never include

Seed phrase, private key, mnemonic, or wallet unlock signature

Raw recovery note, recovery kit, note secret, or blinding value

Private witness, proving intermediate, or decrypted note record

Relayer credential, provider token, private endpoint, or deployment secret

User-identifying data or unredacted browser storage

Live exploit instructions that enable immediate fund movement

If sensitive material is essential to reproduce the issue, first agree on an encrypted exchange method through the independently verified private channel. Do not send the material in an unsolicited first contact.

Severity signals

Signal	Examples
Direct value risk	Unauthorized withdrawal, double spend, inflation, insolvency, or permanently stuck funds
Authorization break	Replay across chain or pool, recipient substitution, relayer scope bypass, or unrestricted signing
Proving-boundary break	Witness leakage, artifact substitution, public-input mismatch, or verifier-binding failure
Recovery break	Import accepts altered authority, cross-runtime confusion, or secret disclosure
Availability or integrity	RPC manipulation, stale accounting, corrupted cache identity, or deployment-origin compromise

Severity depends on exploitability, affected value, required access, detectability, and the recovery path. Describe those facts directly without overstating a privacy or production claim.

Verification

Reporting

Report a Nullark vulnerability

Private reporting channel

Report structure

Never include

Severity signals

Private contact still pending

​Private reporting channel

​Report structure

​Never include

​Severity signals

​Private contact still pending

Private reporting channel

Report structure

Never include

Severity signals

Private contact still pending