Please see Releases. We recommend using the most recently released version.

Public announcements of new releases with security fixes and of disclosure of any vulnerabilities will be made in Nimiq's blog.

We’re extremely grateful for security researchers and users that report vulnerabilities to the Nimiq community. All reports are thoroughly investigated.

Nimiq’s Bug Bounty Program is currently suspended while it is under review as part of a broader restructuring aimed at improving clarity and consistency for security researchers.

Please do not file a public ticket mentioning any vulnerability.

The Nimiq community asks that all suspected vulnerabilities be privately and responsibly disclosed.

To report a vulnerability, email the security@nimiq.com list with the details of reproducing the vulnerability. While the Bug Bounty Program is suspended, reports submitted through this process will still be reviewed. For additional context, see our bug bounty page.

While the primary focus of this disclosure process is the Albatross protocol, the Nimiq wallet and Keyguard, the team may be able to assist in coordinating a response to a vulnerability in third-party apps or tools in the Nimiq ecosystem.