We provide security updates for the following versions:

This frontend repository (scout-off/scout-off-frontend) — including:

• Next.js application code (app/, components/, hooks/, lib/)
• API routes (app/api/)
• Server-side logic (IPFS upload proxy, SEP-10 authentication, referral handling)
• Build and CI/CD configuration
• Environment variable handling and configuration validation

• The smart-contract repository (scout-off/scout-off-contracts) — see its own security policy
• Third-party services we depend on (Stellar network, Pinata IPFS, Sentry, Vercel)
• Issues in dependencies that are already reported upstream
• Theoretical attacks without a practical demonstration

We use GitHub Private Vulnerability Reporting for responsible disclosure. Do not file a public GitHub issue for a security vulnerability.

1. Go to the Security Advisories page: https://github.com/scout-off/scout-off-frontend/security/advisories/new

2. Fill in the details:

   • Title: Brief description of the vulnerability
   • Description: Steps to reproduce, impact, and any suggested fix
   • Severity: Your assessment of the impact (critical, high, medium, low)
   • Affected versions: Which releases are affected

3. Submit the advisory — it remains private until we resolve it.

If you're unable to use the GitHub form for any reason, you may alternately email security@scoutoff.app — but the GitHub advisory is strongly preferred as it provides structured fields and automatic tracking.

We will work with you to understand the issue and ensure it is addressed promptly. You will be credited in our security acknowledgments (unless you prefer to remain anonymous).

We thank the following researchers for their responsible disclosures:

None yet — be the first!

This project also publishes an RFC 9116 security.txt file at: https://scoutoff.app/.well-known/security.txt