| Version | Supported |
|---|---|
| latest | ✅ |
If you discover a security vulnerability in this project, please report it responsibly:
- Do NOT create a public GitHub issue for security vulnerabilities
- Email the maintainer directly or use GitHub's private vulnerability reporting feature
- Include as much detail as possible:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
- Acknowledgment: Within 48 hours
- Initial Assessment: Within 7 days
- Resolution Target: Within 30 days for critical issues
This project implements the following security measures:
- Dependency scanning via Dependabot
- Secret scanning enabled (gitleaks in CI, custom rules in
.gitleaks.toml) - Code scanning (where applicable)
- Signed commits required from maintainers
- SSRF guard on user-supplied webhook URLs (
src/lib/security/ssrfGuard.ts) — private/reserved addresses rejected at mint time and before every delivery
- We follow coordinated disclosure
- Security patches will be released as soon as possible
- Credit will be given to reporters (unless anonymity is requested)