Do NOT open a public GitHub issue for security vulnerabilities.
Please use GitHub's Private Vulnerability Reporting on this repository. Submissions are reviewed privately by core maintainers.
If you are unable to use GitHub private vulnerability reporting, please email security disclosures to security@stellarforge.org.
- Description: Clear description of the vulnerability and affected contracts or SDK modules.
- Reproduction Steps: Proof-of-concept code, minimal steps to reproduce, or transaction payload.
- Impact Assessment: Estimated severity and exploitability.
- Suggested Fix: Optional suggested mitigation or patch.
| Stage | Target |
|---|---|
| Initial Acknowledgement | Within 48 hours |
| Severity Assessment | Within 5 business days |
| Fix Timeline Communicated | Within 7 business days |
| Critical Fix Deployed | Within 14 days of confirmation |
For our full security policy, disclosure guidelines, audit reports, and resolved findings, see docs/SECURITY.md.