Please report suspected security vulnerabilities privately. Use GitHub's private vulnerability reporting for this repository: open the repository's Security tab and select Report a vulnerability. This creates a private discussion with the maintainers. Do not disclose vulnerability details in public issues, pull requests, discussions, or other public channels.

If private vulnerability reporting is unavailable, contact the repository maintainers through GitHub and ask for a private reporting channel. Share only the minimum information needed to establish contact until a private channel is available.

Include a description of the issue, affected component and versions or commit, steps to reproduce, potential impact, and any suggested mitigation. Please avoid accessing or modifying other users' data, disrupting services, or using real funds; use local environments and test networks.

This policy covers security vulnerabilities in this repository's code and configuration, including:

• Stellar/Soroban smart contracts in contracts/
• Backend services and APIs in backend/
• Web and mobile applications in frontend/ and mobile/
• Repository-owned infrastructure, deployment configuration, and CI workflows

Third-party services and infrastructure are out of scope unless the issue is caused by this repository's integration or configuration. Findings that do not create a security risk, and social-engineering attacks against users, are also out of scope.

We aim to:

• Acknowledge a report within 3 business days.
• Complete initial triage and provide an assessment within 7 business days.
• Provide an update at least every 14 calendar days while the report is being investigated or remediated.

These are response targets, not a guarantee of a fix by a particular date. Complex issues may take longer; we will explain delays and keep the reporter updated. Please coordinate public disclosure with the maintainers and allow time for investigation and remediation.

The latest version on the default branch is supported for security reports. Reports affecting released versions are welcome; include the affected version or commit so maintainers can assess impact.