Report privately
Use the Wallet repository’s private GitHub Security Advisory form. The published policy also lists security@glyph.app.
Glyph / security
Security claims require evidence
Report potential Wallet vulnerabilities privately. Do not disclose security issues in a public issue before maintainers can investigate.
Report a vulnerability (opens in a new tab)Wallet boundary
Vault data is encrypted before disk storage. The Wallet repository documents AES-256-GCM, Argon2, local signing, memory clearing on lock, and a constrained Tauri IPC surface.
Release practice
The release workflow validates the expected artifact set and updater signatures before publication. Only the latest Wallet release receives security fixes.
Limits
Glyph does not claim perfect security, reproducible builds, or a third-party audit. OS compromise, social engineering, and physical access to an unlocked device remain outside the published scope.