Synapse is currently on Ethereum Sepolia testnet only. No mainnet deployment exists. Do not use this code in production without an independent audit of the six contracts under packages/hardhat/contracts/.
| Component | Status |
|---|---|
Smart contracts (packages/hardhat/contracts) |
Testnet — unaudited |
Backend orchestrator + node (backend/) |
Testnet — unaudited |
Lit sidecar (services/lit-agent) |
Testnet — unaudited |
Next.js frontend (app/) |
Testnet |
Do not open a public issue for security bugs.
Please report privately via GitHub's Security Advisories tab on this repo.
Include:
- Affected component + file path / commit
- Reproduction steps or PoC
- Impact assessment (fund loss, data exposure, DoS, etc.)
You should receive an acknowledgement within 72 hours. We aim to triage confirmed issues within 7 days and ship a fix before any public disclosure.
- Vulnerabilities in upstream dependencies (
hardhat-deploy,ethers@5,axios) that have no fix available — these are tracked via Dependabot and accepted risk for the testnet build. - Issues that require a compromised RPC provider, compromised Pinata JWT, or physical access to a node's private key.
- Missing rate limits or DoS vectors on local-dev configurations.
Every private key, JWT, and RPC URL lives in .env* files that are gitignored. If you find a secret checked into this repo's git history, report it immediately.