Security fixes are made on main and included in a subsequent release. Older releases are not guaranteed to receive security fixes; use the latest release where possible.

Please report vulnerabilities privately through GitHub's private vulnerability reporting. Do not disclose vulnerability details in public issues.

If private reporting is unavailable, contact a repository maintainer privately before sharing technical details. Include the affected version, impact, and steps to reproduce, and remove secrets or personal data from any attached logs.

Release assets (the .deb packages, the wheels and the coverage report) carry GitHub build provenance attestations, and the release lists their SHA256 sums in SHA256SUMS. Verify an asset with GitHub CLI:

gh attestation verify <asset-path> --repo libmonero/monero-python

or against the sums:

sha256sum -c SHA256SUMS