Do not open a public issue. Use GitHub's private vulnerability reporting, or email security@fabrintek.com.br.

This package authenticates people who meet for the first time. A bug here usually means someone in the middle getting in without the password, or learning something that lets them test passwords offline. Treat anything that touches the messages, the transcript or the confirmation tags as security-sensitive.

Include what you have: the affected version or commit, what an attacker gains, and a reproduction case if you have one. A report without a proof of concept is still worth sending.

Coordinated disclosure: please give the 90-day window before publishing. If a fix is not shipping in that time, you are free to disclose. Reporters are credited unless they ask not to be.

In scope: deviations from draft-irtf-cfrg-cpace-21, message parsing, confirmation, anything that leaks the password or lets an exchange succeed without it. Weaknesses in the draft itself belong to the CFRG (cfrg@ietf.org); in ristretto255 or edwards25519, to those projects.