This security policy applies to software and services maintained by Synonym (including Synonym Software and related open-source projects under Synonym / Pubky organizations), such as:

• Bitkit and related wallet / Lightning components
• Pubky stack (e.g. Pubky App, Pubky Core / Homeserver, Pubky Ring, Pubky Nexus, and related clients)
• Other Synonym-published repositories that link to this policy

If a repository has its own SECURITY.md, that file takes precedence for that repository.

Please treat an issue as a security vulnerability if it could reasonably lead to:

• Loss of funds (theft, unauthorized spend, unsafe key/seed handling, broken signing flows)
• Compromise of keys, seeds, credentials, or session material
• Unauthorized access to accounts, Homeserver data, or private user data
• Loss of privacy beyond normal public /pub/ data (e.g. leaking private keys, auth tokens, or non-public content)
• Remote code execution, privilege escalation, or memory corruption in Synonym software
• Authentication / authorization bypass (including Pubky Ring / pubkyauth flows)
• Critical integrity failures that could cause users to accept false data as authentic in a security-sensitive context

If you are unsure, report it privately anyway. We would rather triage a non-issue than miss a real one.

Please use the public issue tracker (or normal support channels) for:

• Feature requests and general bugs with no security impact
• Social engineering / phishing against users (unless you found a Synonym product defect that enables it)
• Denial of service that requires unrealistic resources, unless it is trivially triggered and clearly impactful
• Issues in third-party dependencies already fixed upstream (feel free to flag them; we may still want a heads-up)
• Security problems only present in unofficial forks, modified builds, or unsupported versions

We aim to address security issues in:

• The latest stable release of each actively maintained product
• Other versions explicitly listed as supported on the product’s release / lifecycle notes

Older or end-of-life versions may not receive patches. When in doubt, update to the latest release before reporting “still vulnerable on my build” follow-ups.

Do not open a public GitHub issue for security vulnerabilities.

Please report privately to:

• Email: security@synonym.to

Include as much as you can:

• Affected product / repository / version (commit hash or release tag if possible)
• Description of the issue and security impact
• Steps to reproduce (PoC welcome; keep it minimal and non-destructive)
• Any suggested fix (optional)
• Your preferred contact and whether you want public credit

If you can, encrypt sensitive details with OpenPGP. Fingerprints / public keys for Synonym security contacts will be listed here when published:

• We acknowledge receipt (target: within a few business days).
• We triage severity and confirm the issue.
• We work on a fix and, where needed, coordinate disclosure.
• We may ask for more details or a quiet period while users can update.
• After a fix is available (or we close the report), we can discuss credit and public write-up.

We ask reporters not to disclose publicly until we have confirmed a fix is available, or we have agreed on a disclosure date, except where legally required or where users face immediate active exploitation (in which case contact us ASAP).

Report via security@synonym.to as described above.

Synonym products often touch keys, funds, and identity. Responsible disclosure protects users. Thank you for helping to keep the ecosystem safer.