Please report vulnerabilities through GitHub's private vulnerability reporting feature for this repository. Do not open a public issue for an unpatched vulnerability or include real recovered secrets or case data in a report.

Include the affected version, impact, reproduction steps using synthetic data, and any suggested mitigation. You should receive an acknowledgement within seven days.

Cold Digger processes hostile and highly sensitive input. Reports and case directories may contain private keys, seed phrases, browser history, personal files, and unredacted media. Keep cases on encrypted storage with restrictive permissions, and do not publish them with bug reports.

Only the latest release receives security fixes. Cold Digger is an analysis tool, not a sandbox for opening recovered files.