Please do not open a public issue for a security problem. Write to biscuitwallet@tutamail.com, with enough detail for us to reproduce it: the version, the system, the steps, and what an attacker could do.

We answer as soon as we can, fix confirmed issues first, and credit you in the release notes if you wish.

The code of the latest release published on biscuitwallet.com/download, built and signed by us (see Verifying your download). Issues that come from Feather Wallet or Monero are welcome too; we pass them on upstream.

Biscuit does not run a bug bounty program for now.

Releases and updates are signed with this key, also built into the app:

The public key is published at biscuitwallet.com/files/releases/biscuit-release-key.asc.

Nobody from Biscuit will ever ask for your seed, your password or your private keys.