# Security Policy

This security policy applies to the "core" crates in the rust-bitcoin ecosystem, which are
`bitcoin`, `secp256k1`, `bitcoin_hashes` and `bitcoin-internals`. These crates deal with
cryptography and cryptographic algorithms, and as such, are likely locations for security
vulnerabilities to crop up.

As a general rule, an issue is a security vulnerability if it could lead to:

* Loss of funds
* Loss of privacy
* Censorship (including e.g. by attaching an incorrectly low fee to a transaction)
* Any "ordinary" security problem, such as remote code execution or invalid memory access

In general, use your best judgement in determining whether an issue is a security issue. If not,
go ahead and post it to the public issue tracker.

**If you believe you are aware of a security issue**, please contact Andrew Poelstra at
`rust-bitcoin-security@wpsoftware.net`. You may GPG-encrypt this email to his public key, which
[can be downloaded from his website here](https://wpsoftware.net/andrew/andrew.gpg) or which is
listed in full below.

# Andrew Poelstra's GPG Key

-----BEGIN PGP PUBLIC KEY BLOCK-----

[encoded data, 33150 characters]
dpxrlOWOxI9jmzuQ75LO
=WxeH
-----END PGP PUBLIC KEY BLOCK-----

