Please do not open a public GitHub issue for security bugs.
Report vulnerabilities privately using one of:
- Preferred: email caravan@unchained.com
- GitHub private vulnerability reporting
- A clear description of the issue and its impact
- Affected packages or versions, if known
- Steps to reproduce, or a proof of concept when possible
In scope
The Caravan Coordinator app and @caravan/* packages in this monorepo
Out of scope
- Third-party hardware wallet firmware
- External block explorer or API services
Security fixes target the latest release on main and the corresponding published npm packages. We do not maintain a separate long-term support matrix.