Security Policy

Supported Versions

Version	Supported
0.1.x	✅

We take the security of arc-nano-kit seriously. If you believe you have found a security vulnerability, please report it to us as described below.

Please do NOT report security vulnerabilities through public GitHub issues.

Send an email to security@arc-nano-kit.dev with the following information:

Type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
Full paths of source file(s) related to the issue
The location of the affected source code (tag/branch/commit or direct URL)
Any special configuration required to reproduce the issue
Step-by-step instructions to reproduce the issue
Proof-of-concept or exploit code (if possible)
Impact of the issue, including how an attacker might exploit it

Acknowledgment: Within 48 hours
Initial assessment: Within 1 week
Fix timeline: Depends on severity, typically within 2 weeks for critical issues

The following are in scope for security reports:

USDC payment handling — Any vulnerability in payment signing, verification, or settlement
Key management — Issues related to wallet key storage, exposure, or misuse
Middleware bypass — Circumventing payment verification in Express/Next.js middleware
Gateway interactions — Vulnerabilities in Circle Gateway API integration
Data exposure — Unintended exposure of billing data, usage metrics, or user information

When using arc-nano-kit in production:

Never commit .env files — Use environment variables or secrets managers
Rotate wallet keys regularly — Especially for seller-side payment collection
Use HTTPS only — x402 payment headers contain sensitive authorization data
Validate payment amounts — Always verify amounts server-side, never trust client input
Monitor Gateway balances — Set up alerts for unexpected balance changes
Keep dependencies updated — Run npm audit regularly