Do not open a public GitHub issue for security vulnerabilities.

Report security issues directly to the maintainer:

Response SLA:

• Acknowledgement within 24 hours
• Initial triage within 72 hours
• Fix or mitigation plan within 7 days for critical issues

We follow coordinated disclosure. Please allow 90 days before public disclosure to give us time to patch and notify affected users.

• 0G Network infrastructure itself (report to 0G Labs)
• Supabase platform (report to Supabase)
• Vercel/Render hosting (report to respective platforms)
• Social engineering attacks targeting the team
• Vulnerabilities requiring physical access to infrastructure

• SmartChainAgentMarket has not yet received an external audit. The contract uses the same security patterns as audited contracts, but users should exercise caution with large values until an external audit is completed.
• Contracts are deployed on testnet. Mainnet deployment will be preceded by a full third-party audit.

• All user-specific API routes validate Supabase JWT before returning data
• Supabase Row Level Security (RLS) ensures users can only read/write their own data
• Service role key is server-side only — never exposed to the browser

All write-heavy API endpoints are rate-limited to prevent abuse:

• All API inputs validated for type and range before processing
• bytes32 encoding validated client-side with byte-aware truncation
• Transaction amounts validated against minimum thresholds
• Webhook signatures validated (Stripe: stripe-signature; Flutterwave: verif-hash)

The following secrets are never committed to git and are server-side only:

STORAGE_PRIVATE_KEY          — 0G wallet private key (server-side only)
SUPABASE_SERVICE_ROLE_KEY    — Supabase admin key (server-side only)
STRIPE_SECRET_KEY            — Stripe API key
STRIPE_WEBHOOK_SECRET        — Stripe webhook signing secret
FLUTTERWAVE_SECRET_KEY       — Flutterwave API key
FLUTTERWAVE_WEBHOOK_HASH     — Flutterwave webhook hash
PRIVATE_KEY                  — Contract deployer wallet (blockchain .env)

Verify no secrets are in git history:

git log --all --full-history -- "**/.env*"
git grep -r "sk_live\|sk_test\|0x[a-fA-F0-9]\{64\}" -- "*.ts" "*.js" "*.py"

• All cross-origin 0G indexer calls are proxied through Next.js API routes (browser never contacts 0G indexer directly)
• Supabase anon key is intentionally public; RLS policies enforce data isolation

# Check for known vulnerabilities
npm audit --audit-level=high

# Check outdated dependencies with known CVEs
npm outdated

• All user-generated content rendered via React (auto-escaped)
• No dangerouslySetInnerHTML usage
• Content Security Policy headers set via next.config.ts

Critical incident:

1. Pause affected smart contracts (if pause() available)
2. Notify affected users via on-chain event + email
3. Engage external auditor for emergency review
4. Deploy fix + re-audit before re-enabling

High incident:

1. Assess scope and blast radius
2. Implement emergency mitigation (rate-limit, disable endpoint)
3. Patch and deploy within 4 hours
4. Post-mortem within 48 hours

A formal bug bounty program will be launched alongside mainnet deployment. Interim rewards:

Last updated: May 2026