Security fixes currently target the latest commit on main. The v0.3.0 APK is an experimental, mainnet-capable pre-release and is not independently audited.

Please do not disclose suspected vulnerabilities in a public issue, discussion or pull request.

Use the repository's Security → Report a vulnerability form to open a private vulnerability report:

https://github.com/tevfikefeaydin/BitcoinWallet/security/advisories/new

Include affected versions, reproduction steps, impact, relevant logs with secrets removed, and a proposed fix if available. Do not include real wallet seeds, private keys, PINs or funded addresses.

You should receive an initial acknowledgement within seven days. No bounty or response-time guarantee is currently offered.

This policy is a reporting channel, not a security certification. Review SECURITY_PREAUDIT_0.3.0.md before using the application with real Bitcoin.