We actively maintain and patch security vulnerabilities in the following branches:

If you are running a fork or a pinned version that is no longer on a supported branch, please upgrade to main before reporting.

The following components are in scope for security reports:

Out of scope: third-party services (Stellar network itself, anchor operators, GitHub infrastructure), social engineering, physical attacks.

Please do NOT open a public GitHub issue for security vulnerabilities. Public disclosure before a fix is available puts all users at risk.

Use GitHub's built-in private reporting:

1. Go to the Security tab of this repository.
2. Click "Report a vulnerability".
3. Fill in the details. Only maintainers can see the report.

GitHub documentation: Privately reporting a security vulnerability

Send a report to security@chioma.dev with:

• A clear description of the vulnerability
• Affected component and version/branch
• Step-by-step reproduction instructions
• Potential impact and severity (Low / Medium / High / Critical)
• Any proof-of-concept code (optional but helpful)
• Your suggested fix, if you have one

PGP encryption is not required but is welcome if you need it — reach out first and we will exchange keys.

We will keep you updated at each stage. If you do not hear back within 48 hours, please follow up — your email may have been caught by spam filters.

We follow a coordinated disclosure model:

• We ask that you give us a reasonable amount of time (see timelines above) to fix the issue before publishing your findings.
• We will credit you in the security advisory unless you prefer to remain anonymous.
• We will not pursue legal action against researchers who act in good faith and follow this policy.

We do not currently operate a formal bug bounty programme. We are deeply grateful for responsible disclosures and will credit all reporters publicly in our security advisories.

Security advisories will be published under the Security Advisories tab of this repository after coordinated disclosure.