Do not open a public GitHub issue for security vulnerabilities.

The security email is monitored and confirmed reachable. If you prefer encrypted reporting, encrypt your message with the PGP key above (or request the key out-of-band via a GitHub private advisory) before sending it to the security email.

You will receive acknowledgement within 48 hours and a resolution timeline within 7 days.

A Critical fix that cannot ship within 30 days receives a status update to the reporter every 7 days until it is deployed, so a late fix is never silent.

We pay for responsible disclosure. The reward tier is set by the severity of the report, using the same severity scale as the response SLA above.

Rules that apply to every tier:

• Reports must be made through one of the channels above and must be actionable — a reproducible path to the impact, not a theoretical concern.
• The reward is forfeited if the reporter publicly discloses the issue before the coordinated disclosure date, or if the reporter knowingly exploits the issue against funds, users, or the protocol.
• Reports that turn out not to be vulnerabilities are not a finding against the reporter; they are not eligible for a reward tier, and this is stated in the severity assessment so the outcome is never a surprise.
• Only the first reporter of a given issue is eligible for the reward. Duplicate reports are credited in the Hall of Fame unless the reporter asks otherwise.
• The monetary reward amount for Critical findings is TBD. Until it is published, the other tiers (acknowledgement, swag, Hall of Fame listing) apply as described above.
• A separate contributor bounty program exists for implementation work such as fixes and documentation. It does not replace this programme and is not additive to it.

We thank the following researchers for responsibly disclosing vulnerabilities. Reporters are listed with their preferred name or handle, unless they ask to remain anonymous.

Reports are added to this table when the corresponding fix ships publicly. Researchers who prefer to stay anonymous are listed as Anonymous with the finding and date only.

Reporters are credited (unless they prefer to remain anonymous) in the Hall of Fame and in the release notes at the time of public disclosure. We ask reporters not to disclose the issue publicly until the coordinated disclosure date.

The Responsible Disclosure Rewards programme applies to:

• In scope: contracts in contracts/ (stream and token) and deployment scripts in scripts/
• Out of scope: third-party dependencies, the Stellar network itself, social engineering, and issues already listed in audits/remediation.md

For implementation work — fixing a finding, writing documentation, improving the toolchain — see the separate contributor bounty program.

All high and medium findings from the April 2026 audit have been resolved. One low-severity finding (LOW-02: re-initialization guard) remains open and must be resolved before mainnet deployment. See audits/remediation.md for the full status breakdown.

Admin key compromise is a Critical residual risk in the threat model (RR-01). To mitigate it, the admin address on mainnet must be a multi-sig account — either a Stellar native multisig account or a deployed multisig contract — with a minimum 2-of-3 signer threshold. A single-key admin is not permitted on mainnet.

Full setup, onboarding checklist, and verification steps are documented in docs/security/admin-multisig.md. All admin calls (including pause/resume, upgrades, and key rotation) must be signed by the multisig per the operations runbook.

If the admin keypair needs to be rotated (planned or emergency), follow the step-by-step runbook in docs/security/key-rotation.md. On mainnet, rotation must be executed through the admin multisig described in docs/security/admin-multisig.md.

• All state-changing functions require explicit require_auth() from the relevant party
• Employer cannot withdraw employee funds; employee cannot access unearned funds
• Claimable amount is always capped at deposit - withdrawn — no over-payment possible
• Cancel pays employee their earned share first, then refunds employer the remainder
• Paused time is excluded from accrual — last_withdraw_time is reset on resume
• All token amounts use i128 — no floating-point arithmetic
• Stop time is validated to be in the future at stream creation