Please DO NOT open public GitHub issues for security vulnerabilities.

If you discover a critical security vulnerability:

1. Email: security@fanilab.com
2. Subject: [SECURITY] Brief description
3. Include:
   • Detailed description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity
  • Critical: 1-3 days
  • High: 1-2 weeks
  • Medium: 2-4 weeks
  • Low: Next release cycle

• We practice coordinated disclosure
• We will work with you to understand and fix the issue
• Public disclosure after fix is deployed (typically 90 days)
• You will be credited in our security advisories (if desired)

• All production smart contracts on Mainnet
• Testnet contracts for design flaws only

• Critical: $10,000 - $50,000 (funds at risk)
• High: $5,000 - $10,000 (significant impact)
• Medium: $1,000 - $5,000 (moderate impact)
• Low: $100 - $1,000 (minimal impact)

• Issues in third-party dependencies
• Known issues already reported
• Theoretical vulnerabilities without proof of concept
• Social engineering attacks
• DoS attacks on public endpoints

• Be respectful and professional
• Do not publicly disclose before fix
• Do not exploit vulnerabilities
• Provide clear reproduction steps
• One bounty per unique vulnerability

1. Never share your private keys
2. Verify contract addresses before interacting
3. Use hardware wallets for large amounts
4. Monitor your transactions
5. Report suspicious activity

1. Read our Security Audit Checklist
2. Follow Stellar security guidelines
3. Review all PRs for security implications
4. Keep dependencies updated
5. Use static analysis tools

• Two-step admin transfer
• Per-function authorization checks
• No hidden backdoors
• All privileged operations emit events

• Checks-effects-interactions pattern
• Balance verification before transfers
• Saturating math to prevent overflow
• Escrow isolation

• Comprehensive state transition validation
• TTL management for all storage
• No orphaned state possible
• Atomic operations

• Email: security@fanilab.com
• PGP Key: [Link to PGP key]
• Discord: FaniLab Official Server

• Security Audit Checklist
• Deployment Guide
• Testing Guide
• Stellar Security Best Practices

Last Updated: January 2026