For a detailed analysis of our trust assumptions, attack vectors, and protocol invariants, please review our Security Model.

Only the latest main branch and active releases are supported with security updates.

If you discover a security vulnerability, please do not report it publicly.

Use GitHub Private Vulnerability Reporting to submit private reports directly to the maintainers. This channel has been tested end-to-end and ensures confidential triage.

If GitHub Private Vulnerability Reporting is unavailable, send an email to security@accensa.dev or contact maintainers via direct message in the Stellar Developer Discord.

• ReceiptAnchor Soroban smart contract (contracts/receipt-anchor).
• RefundVault Soroban smart contract (contracts/refund-vault).
• On-chain Soroban state transitions, access control, double-refund protections, and Merkle root verification.
• Live testnet deployments documented in DEPLOYMENTS.md.

• Merchant private key management and custody.
• Off-chain indexer, dashboard, and SDK repositories (covered in accensa-app).
• Stellar network RPC nodes and third-party RPC providers.
• Protocol-level Soroban host environment or Stellar consensus vulnerabilities.

• Initial Triage: Maintainers will acknowledge and perform initial triage within 48 hours.
• Progress Updates: Status updates will be provided every 5 business days until a fix or patch is ready.
• Coordinated Disclosure: We adhere to a standard 90-day coordinated disclosure window (or mutually agreed release date) before publishing advisory details.