This backend talks to OracleDesk contracts deployed on Stellar testnet only. Nothing has been professionally audited. Don't run it with mainnet funds or keys. See docs/STATUS.md for what is and isn't verified.

Report privately, not in a public issue:

• GitHub Security Advisories for this repository, or
• email SECURITY-CONTACT-TBD@example.invalid

In scope, for example:

• Logging in as an address you don't control (/auth/challenge, /auth/verify).
• Getting a subscription without a matching on-chain USDC transfer, or reusing someone else's payment (payment-verification.service.ts).
• Reaching an admin endpoint without being in ADMIN_ADDRESSES.
• Making the backend sign or submit a transaction in dry-run mode, or on a network other than testnet in live mode.
• A trace marked verified whose bytes don't match the on-chain hash.
• Secrets in logs or API responses.

Out of scope: the contracts (report to OracleDesk-SmartContract), the frontend (report to OracleDesk-Frontend), and third-party dependencies unless this repo's use of them is what's exploitable.

Channel accounts are configured on Stellar testnet exclusively as parallel transaction source accounts to prevent sequence collisions during concurrent agent submissions. Channel keys hold only minimal fee XLM and have no permissions, roles, or allowances in the treasury or market-core contracts. Compromise of a channel key cannot move treasury capital, create markets, or trade shares, as all privileged operations require invocation authorization entries signed by the agent key (AGENT_SECRET_KEY).