Security

Reporting a flaw in the protocol

If you find a weakness in the Dead Canary Protocol itself (a way to game results, leak labels, defeat commitments, or compromise witness independence), report it privately to the maintainer, Nebulonium, Inc., before public disclosure. Open a GitHub security advisory on this repository or contact the maintainer directly.

Embargoed canaries

This repository never contains embargoed canary contents or details of undisclosed vulnerabilities. Embargoed canaries are published here only as commitments until coordinated disclosure is complete (SPEC Section 7).

Do not submit exploit code, live attack payloads, or undisclosed vulnerability details in issues or pull requests.