To report security issues send an email to security@satoshilabs.com (this is not a support email!).

The following keys may be used to communicate sensitive information to developers:

You can import a key by running the following command with that individual’s fingerprint: gpg --recv-keys <fingerprint>.

More info about our Responsible Disclosure program is available from https://trezor.io/security/