Found a security vulnerability? Report it privately in the affected component's own repository — open the repo's Security tab and choose Report a vulnerability. Never file a public issue. If a repository has private reporting disabled, you are unsure which component is affected (for example the proof server, which has no public repository), or you do not get a response within 3 business days, email security@midnight.foundation.