Do not open a public GitHub issue for security vulnerabilities.

Report security issues directly to the maintainer:

Response SLA:

• Acknowledgement within 24 hours
• Initial triage within 72 hours
• Fix or mitigation plan within 7 days for critical issues

We follow coordinated disclosure. Please allow 90 days before public disclosure to give us time to patch and notify affected parties.

• Stellar Network infrastructure itself (report to Stellar Development Foundation)
• Supabase platform (report to Supabase)
• Vercel/hosting platform (report to Vercel)
• Social engineering attacks
• Vulnerabilities requiring physical access to infrastructure
• Rate-limit bypass via distributed IPs (accepted limitation on free tier)

External audit is scheduled before Stellar Mainnet deployment. No production funds are at risk on Testnet.

Every authenticated API route validates the Supabase JWT before executing:

// lib/middleware/auth.ts
const { data: { user }, error } = await supabase.auth.getUser(token);
if (error || !user) return res.status(401).json({ error: "Unauthorized" });

Supabase Row-Level Security ensures users can only read/write their own org's data, even if application code contained a bug.

Write-heavy and sensitive endpoints are rate-limited in lib/middleware/rateLimiter.ts:

All API inputs are validated with Zod schemas before processing:

// lib/validation/schemas.ts
export const submitActionSchema = z.object({
  action_type: z.number().int().min(0).max(9),
  description: z.string().min(10).max(500),
  evidence_hash: z.string().length(64).regex(/^[a-f0-9]+$/),
});

No raw SQL. All database operations use Supabase's parameterized query builder.

The following secrets are server-side only and never exposed to the browser:

STELLAR_ADMIN_SECRET_KEY      — Soroban transaction signing
SUPABASE_SERVICE_ROLE_KEY     — Supabase admin operations
STRIPE_SECRET_KEY             — Stripe API
STRIPE_WEBHOOK_SECRET         — Stripe webhook signature

Verify no secrets are committed to git history:

git log --all --full-history -- "**/.env*"
git grep -r "sk_test\|sk_live\|S[A-Z0-9]\{55\}" -- "*.ts" "*.tsx"

All Stripe webhook events are verified using the signing secret before processing:

const event = stripe.webhooks.constructEvent(
  rawBody,
  req.headers["stripe-signature"],
  process.env.STRIPE_WEBHOOK_SECRET!
);

Unverified webhook calls are rejected with 400.

npm audit --audit-level=high
npm outdated

Run before every deployment. Critical and high vulnerabilities block release.

• All user-generated content rendered via React (auto-escaped)
• No dangerouslySetInnerHTML usage anywhere in the codebase
• User-submitted action descriptions are sanitized before storage

Critical incident (smart contract / key exposure):

1. Rotate STELLAR_ADMIN_SECRET_KEY immediately
2. Assess if any unauthorized minting occurred (check Stellar Expert)
3. Notify affected organizations via email
4. Engage external reviewer for emergency contract assessment
5. Post-mortem published within 7 days

High incident (data breach):

1. Assess scope using Supabase audit logs
2. Disable affected API routes if necessary
3. Patch and redeploy within 4 hours
4. Notify affected users
5. Post-mortem within 48 hours

A formal bug bounty program will be launched at Mainnet deployment. Interim recognition:

Last updated: June 2026