Please do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities privately via GitHub Security Advisories. This ensures the issue is handled confidentially before any public disclosure.

Include in your report:

• A clear description of the vulnerability
• Steps to reproduce or a proof-of-concept
• Affected component (smart contract, frontend, CI/CD)
• Potential impact assessment

We follow coordinated disclosure. We will credit reporters in the release notes unless anonymity is requested.

The following are not considered vulnerabilities for this project:

• Issues in third-party dependencies already tracked by npm audit or cargo audit
• Theoretical attacks with no practical exploit path
• Denial-of-service via excessive on-chain transactions (Stellar network rate limits apply)
• Social engineering or phishing attacks targeting end users
• Vulnerabilities in Stellar/Soroban core infrastructure (report those to Stellar's bug bounty)
• Issues only reproducible on unsupported versions

This project does not currently operate a paid bug bounty program. We do publicly acknowledge security researchers who responsibly disclose valid vulnerabilities in our release notes and CHANGELOG.