Repository navigation
Write the Security Policy and Vulnerability Disclosure Process #510
Description
Description 📝
The repository has no SECURITY.md, so anyone who finds a vulnerability in contracts that hold merchant funds has no private way to report it. Add a security policy and disclosure process.
Proposed Steps 📝
- Create
SECURITY.mdat the repository root. - Define supported versions and deployments in scope (contracts, networks) and what is out of scope.
- Provide a private reporting channel (GitHub private vulnerability reporting and/or a dedicated email) and explicitly ask reporters not to open public issues.
- Define response timelines: acknowledgement, triage, fix, and coordinated disclosure.
- Describe how the team will respond to a live vulnerability, linking the pause mechanism and incident response runbook.
- State the bug bounty position (none, informal, or program link) and safe-harbour language for good-faith research.
- Enable GitHub private vulnerability reporting in repository settings.
Acceptance Criteria ✅
SECURITY.mdexists and GitHub shows it in the repository's Security tab.- A private reporting channel and response timelines are defined.
- Scope and safe-harbour language are included.
Activity
Netty-kun commentedon Oct 19, 2026
@Netty-kun has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Netty-kun to this issue.
Anekenonso commentedon Oct 20, 2026
I have submitted the complete implementation for #510 in PR #514: #514
Covered deliverables:
Tekh134 commentedon Oct 20, 2026
@Tekh134 has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Tekh134 to this issue.
Anekenonso commentedon Oct 20, 2026
@Anekenonso has applied to work on this issue as part of the Stellar Wave Program's 10th wave.
ℹ️ Repo Maintainers: To accept this application, review their application or assign @Anekenonso to this issue.
drips-wave commentedon Oct 22, 2026
Congratulations, @Anekenonso! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on October 22, 2026.
🧑💻 @Anekenonso: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.
Warning
When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.
🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.
🌊 Happy Wave 🌊
docs(security): add security policy and vulnerability disclosure proc…
Anekenonso commentedon Oct 22, 2026
Submitted solution in PR #558 (rebased cleanly on latest \main). Ready for review! cc: @codebestia
drips-wave commentedon Oct 26, 2026
This issue has been marked as completed by a Drips Wave moderator for @Anekenonso as part of the Stellar Wave Program's 10th Wave 🥳
Moderator's reason: [Auto-assessed] The PR was closed rather than merged, but the contributor @Anekenonso successfully completed the requested deliverables for #510 by creating a comprehensive SECURITY.md covering all required aspects (scope, reporting channels, SLAs, emergency response, and safe harbor) and cross-linking it in docs/security/README.md. The issue remains open, and the work directly and cleanly addresses the issue requirements.
😎 @Anekenonso: You earned 200 Points for completing this issue! Once the Wave's rewards are finalized, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here.
🧑💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.
ℹ️ Note: This issue was marked complete via moderation. Points were issued even though the GitHub issue remains open.
Merge pull request #558 from Anekenonso/docs/security-policy-510