ZKPassport is currently under internal and external review. We welcome external submissions of suspected security vulnerabilities. To submit a vulnerability, please use the following procedures.

Do not open public GitHub issues or pull requests for suspected security vulnerabilities.

Instead, please use the Private Vulnerability Reporting process on GitHub.

• Navigate to the "Security" tab of this repository.
• Click "Report a vulnerability" on the left sidebar.
• Fill out the form with the details of your discovery:
  1. Description of the vulnerability and potential impact
  2. Steps to reproduce (including logs, requests, or PoCs as appropriate)
  3. Environment details (OS, network assumptions)

You can also email security@aztec-labs.com, but please don't include the details and steps to reproduce the vulnerability in the email. Use GitHub for the submission.

We will:

• Acknowledge receipt of your report as soon as reasonably possible
• Investigate and validate the issue
• Work on a fix and coordinate disclosure timing with you when appropriate

If you believe a vulnerability is actively being exploited or has severe impact (e.g. broad user impact, soundness bugs), please clearly mark the report as CRITICAL in the pvr/email subject.

Use GitHub Issues to report bugs or issues that are not security-sensitive (performance problems, feature requests, etc.):

Keeping normal bugs and feature requests public helps the community track progress and collaborate on fixes, while keeping security issues private helps protect users until a fix is available.