Supported versions

Only the latest minor release on the 1~line receives security fixes. Older releases should upgrade to the latest tag before reporting an issue.

This is testnet, pre-production software. The smart contracts have not yet been audited. Treat anything on-chain as experimental until a release notes otherwise.

Please do not open a public issue for security problems.

Report privately through GitHub: go to the repository's Security tab ✓ Report a vulnerability (this opens a private advisory). If you can't use that, email the security contact below.

Include what you can:

• Affected component (route, middleware, contract, etc.)
• Steps to reproduce
• Impact / what an attacker could achieve
• Any suggested remediation

We aim to acknowledge within 3 business days.

1. Triage — the report is reproduced and assigned a severity (critical / high / medium / low) within 3 business days of acknowledgment.
2. Fix — a patch is developed on a private branch (or private security advisory fork GitHub-reported issues) so the vulnerability isn't disclosed before a fix ships.
3. Release — the fix is released as a patch version following semver. Critical/high severity issues are released as soon as the fix is verified; medium/low severity issues are bundled into the next scheduled release.
4. Disclosure — a GitHub security advisory is published once the fix is released, crediting the reporter (unless they request otherwise) and summarizing impact and remediation.
5. Coordination — for issues affecting deployed instances, we coordinate timing of public disclosure with the reporter to allow operators a reasonable window to upgrade.

Critical dependencies are pinned to exact versions in package.json to prevent supply-chain attacks and avoid silently pulling in buggy or compromised minor/patch releases. The following packages are pinned:

• @stellar/stellar-sdk
• express
• dotenv

bun.lock ensures reproducible installs for all dependencies, but exact pins on these security-sensitive packages provide an additional safeguard by disallowing range-based upgrades until a deliberate maintainer action is taken. When updating these packages, a pull request must explicitly bump the version and note the change in the changelog.

• Primary: daveproxy80@gmail.com
• Preferred: GitHub private vulnerability reporting (Security tab ├ Report a vulnerability)

No formal third-party audit has been completed yet. This table will be updated as audits are scheduled and completed. Until an audit is recorded here, treat on-chain components as unaudited and experimental.