kawasekit handles cryptographic keys and on-chain value flows. We take security seriously and appreciate responsible disclosure.

Do not open a public GitHub issue for security vulnerabilities.

Instead, email security@k0yote.dev with:

• A description of the vulnerability and its potential impact
• Steps to reproduce (proof-of-concept code if possible)
• Affected version(s) and environment

You can expect an initial acknowledgement within 72 hours. We will keep you informed as we investigate and work toward a fix, and will credit you in the release notes unless you prefer to remain anonymous.

Please give us a reasonable window to address the issue before any public disclosure.

kawasekit is pre-alpha software. Until the 0.1.0 release, only the latest main branch receives security fixes. Milestone tags (v0.0.0-mN) are checkpoints — they do not receive backported fixes.

This policy covers the kawasekit SDK in this repository. Smart contracts live in the separate kawasekit-contracts repository and are covered by its own security policy.

The full threat model — layer-by-layer surface, verdict per threat, and the known limitations kawasekit chooses not to close in this release — lives in docs/THREAT_MODEL.md. That document is the authoritative reference for external security reviewers. If you find a plausible attack that is not addressed there, please report it via the email channel above rather than opening a public issue.