Skip to content

Security: VrajVed/Synapse

Security

SECURITY.md

Security Policy

Supported Versions

Synapse is currently on Ethereum Sepolia testnet only. No mainnet deployment exists. Do not use this code in production without an independent audit of the six contracts under packages/hardhat/contracts/.

Component Status
Smart contracts (packages/hardhat/contracts) Testnet — unaudited
Backend orchestrator + node (backend/) Testnet — unaudited
Lit sidecar (services/lit-agent) Testnet — unaudited
Next.js frontend (app/) Testnet

Reporting a Vulnerability

Do not open a public issue for security bugs.

Please report privately via GitHub's Security Advisories tab on this repo.

Include:

  • Affected component + file path / commit
  • Reproduction steps or PoC
  • Impact assessment (fund loss, data exposure, DoS, etc.)

You should receive an acknowledgement within 72 hours. We aim to triage confirmed issues within 7 days and ship a fix before any public disclosure.

Out of Scope

  • Vulnerabilities in upstream dependencies (hardhat-deploy, ethers@5, axios) that have no fix available — these are tracked via Dependabot and accepted risk for the testnet build.
  • Issues that require a compromised RPC provider, compromised Pinata JWT, or physical access to a node's private key.
  • Missing rate limits or DoS vectors on local-dev configurations.

Operational Secrets

Every private key, JWT, and RPC URL lives in .env* files that are gitignored. If you find a secret checked into this repo's git history, report it immediately.

There aren't any published security advisories