These contracts custody real-world asset value. Please report vulnerabilities responsibly.

Do not open a public issue. Email security concerns to: security@rwa-protocol.dev

Include:

• Description of the vulnerability
• Steps to reproduce
• Impact assessment
• Your contact information

• 48 hours: Acknowledgement
• 7 days: Initial assessment and timeline
• 30 days: Target patch for critical severity
• 90 days: Public disclosure coordination

• Smart contracts in contracts/
• SDK in sdk/
• Deployment scripts in scripts/

• Third-party dependencies (report to their maintainers)
• Social engineering or phishing
• Denial of service attacks on testnet

We consider good-faith security research that follows this policy to be authorized and will not pursue legal action.