Found a vulnerability in some LN software with hundreds of stars in GitHub. The repo has no security policy and does not accept private reporting. The maintainer does not advertise his email but managed to found it in some commits. The GPG used to sign them and other stuff is expired but still being used. I did not manage to convince neomutt to encrypt an email with the expired key, because if I changed the system time, then my key was not yet valid xD
Anyway sent an email asking for a fresh GPG key for the report, the maintainer has not answered after a few days.
Do I just open the issue openly? Or what does one do in this cases?
m0wer
npub1w3…t4c5c
2026-09-05 16:20:55 UTC
Author Public Key
npub1w3vaxva0vcrx7pnvlpmede5smvafdl69xnu7ma82kaxl9us89zdsht4c5cSeen on
wss://nostr.bitcoiner.socialPublished at
2026-09-05 16:20:55 UTCEvent JSON
{
"id": "3b347a84a43def18e1a15db0508c48f3eb000e7d5bfe492520e6b39b81e92085",
"pubkey": "7459d333af66066f066cf87796e690db3a96ff4534f9edf4eab74df2f207289b",
"created_at": 1788625255,
"kind": 1,
"tags": [
[
"r",
"wss://nos.lol/"
],
[
"r",
"wss://relay.snort.social/"
],
[
"r",
"wss://nostr.bitcoiner.social/"
],
[
"r",
"wss://relay.damus.io/"
],
[
"r",
"wss://nostr.sgn.space/"
],
[
"client",
"Primal Web"
]
],
"content": "Found a vulnerability in some LN software with hundreds of stars in GitHub. The repo has no security policy and does not accept private reporting. The maintainer does not advertise his email but managed to found it in some commits. The GPG used to sign them and other stuff is expired but still being used. I did not manage to convince neomutt to encrypt an email with the expired key, because if I changed the system time, then my key was not yet valid xD\n\nAnyway sent an email asking for a fresh GPG key for the report, the maintainer has not answered after a few days.\n\nDo I just open the issue openly? Or what does one do in this cases?",
"sig": "d8583e8e1859a900bdf7d8bf09991f372c2d3b8d4ccb12228b14d74a3b92572cc11e83f8471871e4cc5ed492abdd7305fb421dc7ff4d2195c9008f79d9e2a34f"
}