This document covers repo-specific security boundaries. See the BTCDecoded Security Policy for organization-wide policy.

Security updates are provided for supported protocol versions. See GitHub Releases and Cargo.toml for version history.

This software provides protocol abstraction for Bitcoin implementations. Security vulnerabilities could affect Bitcoin node compatibility and network consensus.

If you discover a security vulnerability in blvm-protocol, please report it immediately:

1. DO NOT create a public GitHub issue
2. DO NOT discuss the vulnerability publicly
3. DO NOT post on social media or forums

Email: security@thebitcoincommons.org
Subject: [SECURITY] blvm-protocol vulnerability

Include the following information:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)
• Your contact information

• Acknowledgment: Within 24 hours
• Initial Assessment: Within 72 hours
• Fix Development: 1-2 weeks (depending on severity)
• Public Disclosure: Coordinated with fix release

• Protocol variant confusion attacks
• Network parameter manipulation
• Validation rule bypasses
• Genesis block spoofing
• Magic number conflicts

• Denial of service through protocol parameters
• Resource exhaustion via network constants
• Input validation bypasses
• Logic errors in protocol selection

• Information disclosure through protocol metadata
• Performance issues with protocol switching
• Documentation errors in protocol specifications

We follow responsible disclosure practices:

1. Private reporting - Report privately first
2. Coordinated disclosure - We'll work with you on timing
3. Credit - We'll credit you (unless you prefer anonymity)
4. No legal action - We won't pursue legal action for good-faith research

• All protocol variants must be clearly separated
• No cross-contamination between networks
• Network parameters must be immutable
• Protocol selection must be secure

• Magic bytes must be unique per network
• Genesis blocks must be cryptographically verified
• Network constants must be tamper-proof
• Protocol versions must be clearly defined

• Protocol-specific rules must be enforced
• No rule bypassing through protocol switching
• All validation must be deterministic
• Edge cases must be handled correctly

Before reporting, please verify:

• The issue reproduces consistently
• The issue affects protocol abstraction
• The issue is not already known
• The issue is not a feature request

We may offer bug bounties for critical vulnerabilities. Contact us for details.

Security updates will be:

• Released as patch versions for security fixes
• Clearly marked as security fixes
• Backported to all supported versions
• Announced on our security mailing list

• Security Team: security@thebitcoincommons.org
• General Inquiries: info@btcdecoded.org
• Website: https://btcdecoded.org

We thank the security researchers who help keep Bitcoin protocol implementations secure through responsible disclosure.

Remember: This software provides critical protocol abstraction for Bitcoin implementations. Any bugs could affect Bitcoin node compatibility and network consensus. Please report responsibly.