Do not open public issues or pull requests for security vulnerabilities.

Instead, report vulnerabilities through one of these channels:

1. GitHub Security Advisory (preferred): Go to the Security tab and click "Report a vulnerability".
2. Email: Send a description to security@mux-protocol.xyz

• Description of the vulnerability and its impact
• Steps to reproduce or a proof-of-concept
• Suggested fix (if any)
• Your contact information for follow-up

We will work with you to understand and validate the issue before any public disclosure.

The following are in scope for security reports:

• Soroban smart contracts under contracts/ — logic bugs, authorization bypasses, storage griefing, overflow/underflow, reentrancy
• TypeScript bindings under bindings/ — error handling flaws that could cause loss of funds or unauthorized actions
• Deployment scripts under scripts/ — key management, access control during deployment
• Configuration — config/addresses.json exposure, network passphrase misconfiguration

The following are out of scope:

• Soroban runtime or Stellar network consensus issues (report to Stellar)
• Denial-of-service against infrastructure (RPC nodes,Horizon servers) unrelated to contract logic
• Social engineering attacks

We support safe harbor for security researchers who:

• Make a good-faith effort to avoid privacy violations, data destruction, or service disruption
• Only interact with accounts you own or have explicit permission to test
• Report vulnerabilities promptly and do not publicly disclose details before a fix is deployed

We will not pursue legal action against researchers who follow these guidelines.

See docs/threat-model.md for the current threat model, trust boundaries, and known mitigations.

See docs/audit-prep.md for audit preparation notes and the docs/access-control-checklist.md for the access control review checklist.

• Email: security@mux-protocol.xyz
• GitHub: Security Advisories
• security.txt: .well-known/security.txt