The latest published release of every public package is supported. Older versions remain available but do not have a blanket backport promise. The current source package versions and runtime profiles are generated in docs/reference/stack-facts.md.

Deployable services under infra/ are supported from reviewed main source and immutable image digests produced by the infrastructure release workflow. An unreviewed fork, locally built image, or mutable tag is outside the supported release boundary.

Do not open a public issue for a suspected vulnerability.

Use a private GitHub security advisory or email security@bsvblockchain.org. Include:

• affected package, service, version, source SHA, or image digest;
• practical impact and deployment assumptions;
• reproduction steps or a proof of concept;
• whether exploitation is observed or believed active; and
• a proposed fix, mitigation, or disclosure constraint if known.

Do not include real private keys, production credentials, personal data, or other unrelated secrets. Use synthetic fixtures or arrange a private handoff.

Active exploitation, exposed signing material, or a compromised release boundary may require immediate mitigation and disclosure. Security fixes do not wait for the normal dependency or feature cadence.

In scope:

• all public packages and private package workspaces under packages/;
• all deployable services, images, and manifests under infra/;
• authentication, payment, wallet, storage, Overlay, messaging, discovery, relay, browser, mobile, and cross-origin behavior;
• conformance runners, generators, build/release scripts, and CI workflows;
• npm/GHCR artifacts, SBOMs, provenance, attestations, and release reconciliation; and
• exploitable first- or third-party dependency behavior in a supported ts-stack artifact.

Especially sensitive boundaries include keys and derivation, signatures and sighash, encryption/HMAC/ECIES, transactions/BEEF/BUMP/Merkle proofs, script evaluation, authentication sessions, payments and replay prevention, parsers of untrusted binary/JSON/network input, URLs/paths/origins, database access, resource bounds, and release credentials.

Purely theoretical issues without a practical path may be deprioritized, but they may still be reported privately. Dependency vulnerabilities should also be reported upstream; they remain in scope here when the supported stack is exposed or needs a mitigation.

Pull requests and releases enforce, as applicable:

• frozen committed locks, denied dependency lifecycle scripts, explicit allowlisted rebuilds, dependency review, Socket analysis, and high/critical audit gates;
• warning-free lint, strict TypeScript build/typecheck, unit/integration, conformance, clean-consumer, browser, mobile, CLI, and WASM package checks;
• governed deterministic/property/native tests for implementation trust boundaries, with replayable seeds; mutation audits run only in the background and raise triage findings without blocking merge or publication;
• CodeQL security-extended analysis, secret scanning, OpenSSF Scorecard, and Sonar semantic review with an exact-head, zero-new-findings merge gate that cannot be bypassed by accepting or marking a new issue false-positive;
• runtime input validation, request/body/rate bounds, replay protection, and synchronized service edge policies;
• digest-pinned Linux/amd64 images, Trivy gates, SPDX SBOMs, SLSA provenance, immutable tags, keyless signatures/attestations, and verification;
• pack-once npm candidates, CycloneDX SBOMs, vulnerability/license scans, GitHub attestations, npm OIDC provenance, and registry digest reconciliation; and
• uniform Apache License 2.0 checks across package and image artifacts.

Coverage-guided fuzzing, remaining manual/browser/performance review, and the final QA hardening campaign are deliberately tracked as unfinished in issue #400. They must not be described as complete until their preserved branch is finished, reviewed, merged, and validated.

Security-relevant changes require an explicit trust-boundary and deployed-impact review, tests that fail on the old behavior when practical, required analysis, and exact-head evidence. Maintainers may facilitate an admin merge after required checks and review-thread resolution; a second reviewer or last-pusher-independent approval is not an unconditional requirement.

Do not dismiss a finding or add an override merely to make CI green. A genuine false positive or unavoidable temporary compatibility substitution must be registered in governance/repository-health/exceptions.json with an owner, rationale, evidence, review deadline, and objective removal condition. Elapsed review deadlines are advisory maintenance reminders in every invocation, including the weekly Maintenance review deadlines workflow; malformed, unowned, or unregistered exceptions still fail CI. Dependency release age does not prevent applying a patched release; vulnerability audits, provenance checks, denied lifecycle scripts, and immutable artifact verification remain required.

The maintainer-approved PR569 Sonar budget is registered in governance/sonar-pr569-budget.json and the exceptions registry. Only the exact PR/repository/head branch/base before 2026-10-24T23:59:59Z may retain visible maintainability-only findings with maintainability A and duplication ≤6%. Bugs, vulnerabilities, all reliability/security impacts, unknown classifications and unreviewed hotspots remain blocking, including accepted/false-positive issues. Complete inventories and original/scoped verdicts are retained; no suppression, exclusion, profile, baseline or finding-state change is authorized. Live PR and exact, stable analysis checks enforce scope; out-of-scope or expired approval returns to the strict gate. CodeQL and all other security/qualification gates remain unchanged. The PR569 merge hold remains.

Public services such as Overlay, Wallet Storage, WAB, Message Box, and Wallet Relay may need to accept clients from previously unknown domains. Their public default and opt-in CORS/CSP/origin allowlists are deployment policy, not a replacement for authentication, authorization, signatures, topic validation, rate limits, or request bounds. A hosting URL or fallback origin must not silently become an allowlist.

Never publish from a workstation. Follow the npm package, container, and release/operations guides.

For a suspected release compromise:

1. stop publication and deployment promotion;
2. preserve workflow, artifact, digest, attestation, and audit evidence;
3. rotate affected credentials and isolate compromised systems;
4. inventory exact package versions and image digests;
5. deprecate and forward-fix immutable npm versions or roll deployments back to a previously verified image digest; and
6. coordinate advisory, consumer guidance, and post-incident control changes.

The separately reviewed PR569 analysis operations in governance/pr569-reviewed-analysis-exceptions.json are the sole additional exception: CodeQL353 intentional private JSON evidence storage and two exact Sonar S2612 required public artifact permissions. Owner BraydenLangley reviewed the operator-delegated decision on October 19. Exact alert identities and SHA-256 source checks apply only to PR569 before October 24 at 23:59:59 UTC. The Sonar inventory and original failed verdict remain visible; reviewed permission keys are reported separately. Their original security C metric is covered only when both exact findings are present; all other security ratings and findings retain strict enforcement. Every other finding, metric, platform and merge gate remains required. Changed source requires fresh review.