Do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities by email to Emmy123222 via the contact on the GitHub profile. Include:

1. A concise description of the vulnerability and its potential impact.
2. Steps to reproduce or a proof-of-concept (PoC) — a minimal code snippet is ideal.
3. The version / commit hash where you observed the issue.
4. Your suggested severity (Critical / High / Medium / Low).

We will acknowledge receipt within 48 hours and aim to provide an initial assessment within 5 business days.

In-scope for this policy:

• contracts/stellar-micropay-contract/ — the Soroban smart contract
• Backend API (backend/)
• Frontend (frontend/)
• Any dependency vulnerability that directly affects users of this project

Out of scope:

• Stellar protocol-level issues — report those to the Stellar Bug Bounty
• Issues in third-party services (Vercel, Docker Hub, etc.)
• Theoretical vulnerabilities without a practical attack path

We follow coordinated disclosure and adhere to defined severity SLAs:

1. Reporter notifies us privately.
2. We investigate and develop a fix following the target SLAs above.
3. We publish a patched release and credit the reporter in the changelog (unless they prefer anonymity).
4. Reporter may publish their findings 7 days after the patch is released, or sooner by mutual agreement.

• Automated Fix Policy: As detailed in CONTRIBUTING.md, npm audit fix --force is strictly prohibited to prevent silent breaking major upgrades.
• Reviewed Lockfile Updates: All dependency updates must be submitted via reviewed lockfile update PRs.
• Exception Ownership: Security waivers or deferred remediations must be approved by Repository Maintainers and Security Leads, require documented compensating controls, and have a maximum time-bound duration of 90 days.

Reports in English are preferred, though we will do our best with other languages.

We gratefully acknowledge security reporters in our CHANGELOG under the release that includes their fix.