Please do not report security vulnerabilities through public GitHub issues. Instead, report them responsibly by contacting security@vatix.io.

• Deny-by-default: Every external entrypoint requires an authenticated principal unless explicitly marked as a probe. Unauthenticated requests to data or money-path routes fail closed with 401 UNAUTHORIZED.
• Rate limiting: Every external route is governed by an explicit policy in RATE_LIMIT_POLICIES (see RATE_LIMIT_POLICY.md). Routes without a policy are denied by default.
• Probe safety: Probe endpoints (/health, /ready) never return connection strings, credentials, hostnames, or internal addresses.
• Fail-closed dependencies: If a critical dependency (database, Redis, RPC) is unreachable, probes return 503 DEPENDENCY_UNAVAILABLE and money paths reject writes immediately rather than serving stale or degraded state.
• Feature flags: Money-path or mainnet-affecting changes must be gated behind a feature flag or kill-switch so they can be turned off without a redeploy.
• Secret hygiene: No secrets, passwords, or connection strings may be checked into the repository or emitted in structured logs.