Provance handles real money. We take security seriously and we want to know about problems before they affect users.

Do not open a public GitHub issue for security vulnerabilities.

Email us at security@provance.xyz with:

• A description of the vulnerability
• Steps to reproduce it
• What you think the impact is

We will respond within 48 hours and keep you updated as we work on a fix.

The things we care most about:

• The Soroban savings vault contract (provance-contracts)
• Anything that could allow funds to be moved without the depositor's authorisation
• Key management and wallet handling

Please give us time to fix the issue before disclosing it publicly. We will credit you if you want.