The TaskBounty team takes security seriously. We appreciate your efforts to help us maintain a secure platform and ask that you responsibly disclose any security vulnerabilities you discover.

Please do not open public GitHub issues for security vulnerabilities.

Instead, please report security vulnerabilities by emailing: security@taskbounty.dev

In your email, please include:

• A clear description of the vulnerability
• Steps to reproduce (if applicable)
• Potential impact and severity assessment
• Your contact information (name and email)
• Your GitHub username (optional)

We ask that you:

• Do not publicly disclose the vulnerability until we've had a chance to address it
• Do not attempt to exploit the vulnerability beyond the minimal testing required to confirm it
• Do not access data that is not yours or modify other users' data
• Give us a reasonable amount of time (typically 90 days) to patch the vulnerability before public disclosure
• Allow us to credit you in our security advisory (if you choose)

• Critical (auth bypass, fund loss, contract exploit): Fix within 1 week; emergency deployment to mainnet
• High (significant data exposure, major functionality bypass): Fix within 2 weeks
• Medium (limited impact, requires specific conditions): Fix within 30 days
• Low (minimal impact, edge cases): Fix within 90 days

We provide security updates for the following versions:

Security updates are provided for the latest minor version of each major release. Users are encouraged to upgrade promptly.

• All smart contracts undergo internal security reviews before mainnet deployment
• We recommend independent audits for contracts handling significant value
• Fund safety is ensured through the escrow pattern: contracts hold funds during task lifecycle
• Authorization uses Soroban's built-in require_auth() for access control
• No reentrancy vulnerabilities due to Soroban's execution model

• HTTP Security Headers (CSP, HSTS, X-Frame-Options) are enforced on all responses
• Input validation on all user-facing forms
• Wallet integration follows Stellar Wallets Kit security best practices
• Environment variable management:
  • Secrets must never be committed (see ENVIRONMENT.md)
  • Only NEXT_PUBLIC_* values may reach the browser — treat them as public
  • Private keys, mnemonics, and API tokens must stay in gitignored .env.local files or a secret manager
  • Templates live in .env.example with empty / placeholder values only

• Transactions leverage Stellar's atomicity guarantees
• All token transfers use standardized Stellar Asset Contract (SAC) interface
• Timestamp-based validations prevent time-based attacks

• Testnet is not production-ready: Do not use testnet for real value transfers
• Smart contract audits pending: Mainnet deployment awaits security audit completion
• Wallet security is user's responsibility: Users must protect their private keys
• Network forks: Users should verify they're on the correct Stellar network (Testnet vs. Mainnet)

1. Never share private keys with anyone, including our team
2. Verify contract addresses before submitting work or posting tasks
3. Use hardware wallets for storing significant funds
4. Test on testnet first before large mainnet transactions
5. Keep your wallet software updated to the latest version
6. Enable 2FA on any associated accounts (Discord, GitHub, etc.)

Currently, we do not have a formal bug bounty program. However, we deeply appreciate security researchers who find and report vulnerabilities responsibly. We will:

• Credit you publicly (if you consent) in our security advisories
• Provide acknowledgment in our README or CONTRIBUTING.md
• Consider your contributions when evaluating future bounty programs

Past and future security advisories will be published at:

• GitHub Security Advisories
• Email notification for major vulnerabilities (opt-in)

Smart contract audits and security assessments will be published when available at:

• /audit/ directory in this repository
• Project website (TBD)

If you have questions about this security policy or our security practices, please reach out to security@taskbounty.dev.

Last Updated: July 2026
Policy Version: 1.0