Security disclosure policy

Report security vulnerabilities in Web3Signer privately, as described in the Web3Signer security policy.

Do not report vulnerabilities through public GitHub issues, pull requests, or discussions.

The security policy describes the reporting channels, what to include in a report, what to expect after reporting, supported versions, and the deployment assumptions used to assess reports.