This SDK signs and verifies payment requests with a merchant private key. If you find a vulnerability, report it privately rather than opening a public issue. That covers signature verification, key handling, webhook verification, or anything else.

Report privately through GitHub Security Advisories. Include:

• the affected version(s) and Python version;
• steps to reproduce, or a minimal example;
• what you expected to happen instead.

In scope: this library's own code (src/). The keys under spec/keys/ and tests/fixtures/ are throwaway test material that signs nothing but test vectors. Real merchant or Presto staging credentials must never be committed.

Before 1.0, only the latest published version is supported. From 1.0, this section will list which major versions still receive security fixes.