MiniChain is released via tagged versions (vX.Y.Z, SemVer), built and published automatically by .github/workflows/release.yml whenever a matching tag is pushed. While the project is pre-1.0 (currently 0.1.0-beta), only the latest tagged release and main receive security fixes — older tags are not backported to.
| Version | Supported |
|---|---|
| Latest tagged release | ✅ |
main (unreleased) |
✅ |
| Older tagged releases | ❌ |
Please do not open a public GitHub Issue for security vulnerabilities. Publicly disclosing a vulnerability before it's fixed can put users at risk.
Instead, report it privately using one of these channels:
- GitHub Private Vulnerability Reporting (preferred): open a report using the "Security" tab on the MiniChain repository.
- Discord DM: send a direct message to one of the maintainers listed in docs/maintainer.md— do not post details in a public channel.
Please include as much of the following as you can:
- A description of the vulnerability and its potential impact.
- Steps to reproduce it (proof-of-concept code, a malicious contract, a crafted P2P message, etc.).
- The affected file(s)/module(s), if known.
- Any suggested fix or mitigation.
- We aim to acknowledge new reports within 14 days.
- We'll work with you to understand and validate the issue, and will keep you updated as a fix is developed.
- Once a fix is released, we'll credit you in the release notes/changelog unless you'd prefer to remain anonymous.
Given MiniChain's goals — education, research, and innovation on a minimal blockchain — vulnerabilities of particular interest include:
- Transaction signature forgery or verification bypass (see
minichain/transaction.py). - Smart contract sandbox escape or gas-metering bypass (see
minichain/contract.py). - Consensus/fork-choice manipulation or state root corruption (see
minichain/chain.py,minichain/state.py,minichain/pow.py). - P2P protocol issues that allow a peer to crash, partition, or deny service to a node (see
minichain/p2p.py). - JSON-RPC issues that allow unauthorized access to node data or funds (see
minichain/rpc.py).
Out of scope: issues in vendor third-party binaries (bore_bin/, bore.zip) should be reported upstream to their respective projects.
For non-security questions, use the Stability Nexus Discord or open a regular GitHub Issue, per CONTRIBUTING.md.