On Nov 4, 2026 we privately reported a serious privacy vulnerability in a live protocol to its team. We sent the hash of the report at 17:28 UTC and the full report at 17:46 UTC, and the team confirmed receipt the same day. Report SHA-256: e236d1a2ee5c7856f92449cc60ddd63b01fcde84d4f9aff1ffc6bf92da670371. We also proposed a fix, and the team says a fix is planned. We follow the standard 90-day coordinated disclosure window, so on or before Feb 2, 2027 we will publish a short statement with no technical details, fixed or not. The team gets the text first. We are not asking for a bounty and we set no conditions. Statement template SHA-256, locked today: 16b9bdd71f47c11bf36bf5e758d5e940408a9c307dbb399e760932692e4d0532. Only the bracketed status line will be filled in, and we will publish the template file next to the statement so anyone can check the hash. The report itself stays private, its hash is for the team and any independent reviewer.