ILN spans Soroban smart contracts, a TypeScript SDK, a CLI, an indexer, and a notifications service. ILN is in experimental/testnet phase — do not use current deployments as mainnet-secure infrastructure until the mainnet checklist, audits, and maintainer sign-off are complete.

For the full policy — including component-specific vulnerability classes, detailed severity definitions, response timelines, reporting instructions, safe harbor, and maintainer handling procedures — see docs/security.md.

Please do not disclose suspected vulnerabilities publicly before maintainers have had time to investigate and remediate them. "Publicly" includes issue and pull-request comments, Discord, Telegram, and social media. If you have already opened a public report, keep the body empty, edit it to a neutral title, and ask a maintainer to convert or hide it.

1. GitHub Security Advisory — preferred. Open a private draft advisory against this repository at https://github.com/Invoice-Liquidity-Network/ILN-Smart-Contract/security/advisories/new. A private advisory is visible only to you and the repository's maintainers, keeps the discussion and any proof-of-concept out of the public issue tracker, and produces a publishable CVE-backed advisory at the end. If that page returns 404, or the "Report a vulnerability" button is absent, private vulnerability reporting is not enabled on this repository yet — see Enabling Private Vulnerability Reporting (Owner Only).
2. Security email — currently unavailable. No ILN-owned security mailbox is reachable today; see Contact Status. Do not send a report to any address marked broken there — it will bounce silently and your report will be lost.

If neither channel works for you, open an ordinary issue whose title and body contain no detail about the finding at all (for example: "Security report — please advise on a private channel") and ask a maintainer to point you at a working one. Never describe the vulnerability, the affected function, or the affected contract in anything public.

• Affected component, and the commit, tag, branch, or deployed contract ID.
• Steps to reproduce, with expected versus actual behavior.
• Impact: which assets, users, or permissions are affected, and whether you believe it is actively exploitable.
• Proof-of-concept code, transaction XDR, logs, screenshots, or traces where available.

Do not include live secrets, private keys, or personally identifiable information unless maintainers explicitly request a secure transfer method.

• Maintain an embargo on all details from the moment you report until maintainers publish a fix, mitigation, or advisory, whichever comes first.
• The default embargo is 90 days from the date of the first report. If a fix is not available after that, contact the maintainers before publishing anything; do not treat 90 days as unilateral permission to disclose.
• Actively exploited or mainnet fund-at-risk findings follow a shorter, mutually agreed timeline — maintainers will propose it in the acknowledgement.
• Maintainers will credit the reporter in the published advisory unless asked otherwise, and will not pursue legal action against good-faith research conducted under this policy (see Safe Harbor).

The channel table below records what a contributor has actually checked, so that nobody wastes a report on an address that cannot deliver it.

An owner should add one verified, ILN-owned security mailbox to this table (and to docs/security.md) once mail delivery for it has been tested end to end. This document deliberately does not invent an address.

Reporters can expect, at minimum:

The 48-hour acknowledgment clock is measured from the moment a report is delivered to a working channel, which is why Contact Status above matters: a bounced email never starts the clock.

See docs/security.md for full details including safe harbor, maintainer handling procedures, and the security checklist for releases.

We operate a continuous bug bounty program to reward researchers for finding vulnerabilities in ILN Smart Contracts.

• In-scope: All production Soroban contracts (contracts/*) deployed to mainnet.
• Out-of-scope: CLI utilities, off-chain indexers, demo scripts.

• Critical: Up to $50,000
• High: Up to $15,000
• Medium: Up to $5,000
• Low: Up to $1,000

Rewards are funded directly from the ILN DAO Treasury multi-sig.

Good faith security research that follows this disclosure policy will be considered authorized. We will not pursue civil or criminal action against researchers who comply with these guidelines.

Contributors cannot enable this; only an owner or a maintainer with repository-admin rights can. Until it is enabled, a signed-in non-collaborator opening the advisory URL in Contact Status receives 404, so reporters have no private channel at all.

1. On GitHub, as a repository admin: Settings → Advanced security → Code security and analysis (the same group is reachable from the repository Security tab → the settings badge) → enable Secret scanning alerts if you want them, and tick Private vulnerability reporting.

2. API equivalents exist only for the other switches. PATCH /repos/{owner}/{repo} accepts security_and_analysis with the keys advanced_security, secret_scanning, secret_scanning_push_protection, and dependabot_security_updates, each with status enable/disable/auto; Dependabot security updates also have a dedicated endpoint:

   gh api -X PATCH repos/Invoice-Liquidity-Network/ILN-Smart-Contract --input - <<'JSON'
   {
     "security_and_analysis": {
       "advanced_security": { "status": "enable" },
       "secret_scanning": { "status": "enable" },
       "dependabot_security_updates": { "status": "enable" }
     }
   }
   JSON
   
   gh api -X POST repos/Invoice-Liquidity-Network/ILN-Smart-Contract/vulnerability-alerts

   Two gotchas worth knowing before you trust a scripted "fix": the endpoint silently ignores keys it does not recognize (secret_scanning_alerts is a GraphQL name, not a REST one, and has_vulnerability_alerts in PATCH -f has_vulnerability_alerts=true is not a documented parameter of this endpoint at all — both return HTTP 200 while changing nothing), and advanced_security answers HTTP 400 "Invalid value for Advanced Security status" on forks or where GHAS is not licensed, in which case use "auto" to inherit the organization setting.

3. There is no REST or GraphQL field that turns on private vulnerability reporting; step 1 is the only way. Verify it took effect with an account that is not a collaborator, signed in to github.com, by opening https://github.com/Invoice-Liquidity-Network/ILN-Smart-Contract/security/advisories/new: disabled renders 404, enabled renders the "Report a vulnerability" form. Do not test this with curl from an unauthenticated shell — GitHub redirects anonymous requests for that page to sign-in, which answers 200 either way and therefore proves nothing.

4. If the checkbox is greyed out, an organization owner has to allow private vulnerability reporting at the organization level first (org Settings → Code security and analysis), and the repository must be public.

5. Once reporting works, update the Contact Status table here and mirror the same wording into docs/security.md.