If you discover a security vulnerability in the Bridgelet SDK, please report it responsibly. Do not open a public GitHub issue for security vulnerabilities.

1. Email: Send a report to aminubabafatima8@gmail.com
2. Subject line: Use the format [SECURITY] Brief description of vulnerability
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact assessment
   • Suggested fix (if any)

• Type of vulnerability: e.g., injection, authentication bypass, information disclosure, denial of service
• Affected component: Contract, SDK, API, claim tokens, etc.
• Attack vector: How an attacker could exploit this
• Severity assessment: Your estimate of CVSS score or severity level (Critical/High/Medium/Low)

The following components are in scope for security reports:

• Smart contracts: EphemeralAccount, SweepController (bridgelet-core)
• SDK backend: bridgelet-sdk (NestJS API, authentication, claim flow)
• Claim tokens: JWT generation, verification, and redemption
• API key authentication: Key hashing, validation, and rotation
• Data handling: Secret key encryption, database storage, webhook delivery

• Third-party dependencies (report these to the respective maintainers)
• Social engineering attacks
• Issues requiring physical access to production infrastructure

• We follow coordinated disclosure. Please give us reasonable time to fix the issue before any public disclosure.
• We will acknowledge receipt within the SLA timeframe.
• We will credit reporters in release notes (unless anonymity is requested).
• We will not pursue legal action against researchers who follow this policy.

• Never commit secrets, private keys, or API keys to the repository
• Use environment variables for all sensitive configuration
• All cryptographic operations must use established libraries (no hand-rolled crypto)
• Follow the principle of least privilege for API key scopes
• All authentication changes require security review before merge