Security

Send suspected vulnerabilities privately to contact@squirrelsystems.net. Include the affected product and version, reproducible steps, expected and observed behavior, and the least-sensitive evidence that demonstrates the issue.

Never include secrets

Do not send a recovery phrase, private key, wallet password, authentication token, signing secret, or a reusable production credential. Squirrel Systems support will never ask for wallet recovery material.

Coordinated disclosure

Please allow reasonable time for triage and remediation before publishing technical details. We will acknowledge actionable reports and coordinate disclosure timing based on severity and user impact.

Product guidance

SQRL-specific reporting and wallet safety guidance is available on the SQRL security page.