Report a vulnerability
How to report a security problem in Mavna privately.
Email eereentopal@gmail.com. Keep the report private: do not open a public issue or post it anywhere else first.
Include whatever you have of the following:
- What an attacker gains, and what they need to gain it.
- The package, and the commit or file if you have it.
- Whether the widget reaches it. The widget runs inside other sites, so a problem there affects every site that embeds it.
- Steps or a test that reproduce it.
What matters most
Every part of Mavna is in scope. The reports that matter most are the ones that break a property on the security model page: the SDK returns transactions unsigned, nothing signs for the person sending, and the sponsor key spends only within its limits. After those come the paths where a wrong value loses funds for good: cross-chain address encoding, the recipient written into a Circle transfer, and any code that decides what kind of address a string is.