For the authentication and authorization model (roles, scopes, JWT flow, API-key namespaces, cookie attributes, and route guards) see docs/SECURITY-MODEL.md.
Only the current main branch and the last tagged release receive security fixes.
| Version | Supported |
|---|---|
| Main | ✅ |
| Last Tag | ✅ |
| Older | ❌ |
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Report privately through GitHub: open the repository's Security tab and click Report a vulnerability. Only the maintainers can see the report.
- A description of the vulnerability and its impact.
- Steps to reproduce it.
- The affected file, endpoint, or contract, and the commit you tested.
- Any relevant logs or output.
- In scope: smart contracts, backend, and frontend code in this repository.
- Out of scope: third-party services, dependencies, and infrastructure not managed in this repository.
- We aim to acknowledge reports within 5 business days.
- We ask for a 90-day disclosure window so we can investigate and ship a fix before details are made public.
DukaPay is an open-source project and does not run a bug bounty program. We do not offer cash, token, or any other rewards for vulnerability reports.
We will not pursue legal action against researchers who:
- Make a good faith effort to avoid privacy violations, data destruction, or disruption to our services.
- Only interact with accounts they own or have explicit permission to use.
- Do not exploit a vulnerability beyond what is needed to confirm it exists.
- Report promptly and do not disclose publicly before a fix is released.