Report vulnerabilities privately to the Bitcoin Universe security contact before public disclosure. Include the affected commit, network, configured protocol identifier, reproduction steps, and whether authoritative roots or carrier classification differ.

Do not include private keys, RPC credentials, database credentials, signing seeds, wallet descriptors, or user transaction data in a report.

Until a coordinated fix is released, stop publishing agreement envelopes if any parser, signature, state, root, or reorg discrepancy is suspected.