Please do not report suspected vulnerabilities through public GitHub issues.

• Preferred: GitHub private vulnerability reporting
• Alternatively: security@germ.network

This is a small project: reports are read, but no response timeline is promised, and there is no bug bounty.

In scope: anything with concrete security impact — key or plaintext disclosure, forged or replayed segments passing authentication, snapshot authentication bypass (tampered, reordered, added, or dropped segments going undetected), or memory-safety failures reachable from untrusted input.

Out of scope: hardening suggestions without concrete impact. Those are welcome as ordinary issues.