keyforge handles key material, so we treat reports seriously.

Please report suspected vulnerabilities privately through GitHub's private vulnerability reporting for this repository. Do not open a public issue, pull request or discussion for a security problem.

Include what you found, how to reproduce it, the affected version, and any impact you have assessed. We will acknowledge a report within three business days and keep you informed of the fix and the disclosure timeline.

Until v1.0.0, only the latest release receives security fixes.

keyforge is pre-1.0 and has not been externally audited. Do not describe a deployment as production-grade on its basis until an independent review is published here. The threat model and known limitations are in the technical requirements (docs/specs/initiatives/INIT-KEYFORGE-001/TRD.md).