Kivuli is a self-custodial privacy wallet distributed as a beta. It has not had an external audit yet, and on Base mainnet it holds real money. Treat every report accordingly: we would rather hear about a false alarm than miss a real one.

Do not open a public issue. Instead, use one of:

• GitHub's private vulnerability reporting on this repository (Security → Report a vulnerability), preferred when available.
• Email support@kivuli.xyz with SECURITY at the start of the subject.
• The contact page at https://kivuli.xyz/contact, marked as a security report.

Include what you can: affected version (Settings → About), steps to reproduce, impact as you understand it, and any proof-of-concept. Reports in plain language are fine; you do not need a CVSS score to be taken seriously.

• Acknowledgment within 3 business days.
• An assessment and a plan (or honest questions) within 10 business days.
• Coordinated disclosure: we ask for up to 90 days before public details, less if a fix ships sooner. We will credit you in the release notes if you want credit, and stay silent about you if you do not.

There is no bug bounty program yet. We say this up front so nobody invests time expecting one; serious reports are still deeply appreciated and credited.

In scope:

• The extension itself: src/ (service worker, provider bridge, UI), the build and packaging pipeline (scripts/, .github/workflows/), and the release artifacts.
• The test bench (demo/), especially anything that could mislead a tester into spending more than the page says it will.

Out of scope, report upstream instead:

• The @opaquecash SDK packages and the protocol contracts they target (report to their maintainers; a heads-up to us is welcome).
• Chrome itself, or issues requiring a compromised browser or OS.

The wallet's threat model in one paragraph: the 12-word phrase is the root of everything; the master secret exists only in service-worker memory while unlocked; the vault, scan cache, and origin map are encrypted at rest; each dApp origin gets an isolated account. A finding that breaks any of those properties is exactly what this policy is for.

Use throwaway wallets and testnet (Sepolia) funds for research whenever possible. Never ask users for their recovery phrase or passcode as part of a demonstration; support will never ask for either, and neither should a researcher.