Please do not report security vulnerabilities through public GitHub issues.

Report them privately by email to team@candidelabs.com, with a description of the issue, the affected version, and steps to reproduce. We will acknowledge the report and keep you informed while we investigate and fix it.

This policy covers the @candidelabs/wdk-protocol-sda-candide package. Issues in the Forwarding Address contracts or API can be reported through the same channel.