Email vulnerabilities to thomas.zarebczan@gmail.com before posting details in an issue or pull request. Use the subject z-stack security report. Include the affected revision, reproduction steps using an empty or regtest wallet, expected behavior, and impact.

Do not include production seeds, decrypted notes, cookies, tokens, or wallet database files. If a report needs sensitive evidence, agree on a private channel with the owner first.

This is preview software. Passing the regression suite is not a security audit. The security and privacy guide describes the application responsibilities and current threat boundaries.