Wayfare is pre-MVP and has no released versions. The only supported version is the current main branch, and that is what fixes land on.

Report privately, through GitHub's private vulnerability reporting form on the repository's Security tab. Please do not open a public issue for a suspected vulnerability.

Include, as far as you can:

• what the flaw is, and which package it lives in;
• the corridor, send amount, and source responses that reproduce it — a cmd/ladder invocation or an /api/corridor request is ideal;
• what a sender loses because of it.

You should get an acknowledgement within a week. There is no bug bounty — Wayfare is an early open-source project and cannot offer payment. If a report is confirmed, we'll agree a disclosure timeline with you and credit you in the advisory unless you'd rather we didn't.

Wayfare holds no funds, no keys, and no user data — it is read-only by design, so the usual list does not map cleanly. What Wayfare produces is a claim about how much of someone's money survives a corridor. The security-relevant failures are the ones that make that claim wrong in the direction that costs the sender money.

These are the bugs that matter most, because someone sends money on the output.

• A quote reporting a higher receive amount, or a lower all-in cost, than the source actually offers.
• Fee arithmetic that adds units of one currency to another, or that applies a fee.asset denomination the wrong way round — the SEP-38 fee identity documented in the README is load-bearing, and breaking it produces a number that looks plausible and is meaningless.
• A verdict of "viable" for a route whose loss against the mid-market rate says otherwise, or any path where a missing reference rate results in a ranking rather than a refusal to score. Scoring against an independent mid is the point; degrading to "cheapest of what we found" is a vulnerability, not a fallback.
• A failed or unreachable source rendered as a priced route, or silently dropped from the set so the survivors look like the whole market.
• Reading a price from a stellar.toml or SEP-38 response for an asset the anchor does not actually issue — including a code-only match passing as a verified issuer.
• Any use of float64 in a pricing path. Money is decimal; a rounding artefact here is a wrong quote, not a cosmetic bug. This extends to the wire: money crosses it as decimal strings, and emitting a JSON number invites a client to reintroduce the same bug downstream.
• Corridor integrity reported better than it is: a DERIVATIVE corridor presented as DIRECT, a dependency dropped from depends_on, or a NO-MARKET corridor rendered as a priced one. The absence of a market and a bad price are different findings, and collapsing them hides the reason a corridor failed.

• Presenting an anchor's or Horizon's number as a Wayfare conclusion, or dropping the source and timestamp from a quote.
• Divergence between the HTTP API and cmd/ladder -json for the same measurement. They share route.ToCorridorJSON precisely so one cannot understate what the other reports; a second, drifting shape is a finding.
• Injection through issuer-controlled content — asset codes, home_domain, stellar.toml fields — into CLI output or into the UI served by wayfared. Issuer-controlled strings are untrusted input, and the TOML salvage path in particular parses hostile, malformed documents.
• Denial of service in the fetch layer: unbounded reads, missing timeouts, or a hostile domain able to stall a quote indefinitely.

• A corridor being terrible. Wayfare reporting that the best route loses 56% is Wayfare working. That is a measurement, not a bug.
• An anchor's rate being bad, or its quote expiring. Quotes are point-in-time and carry a timestamp; the anchor owns its pricing.
• Horizon or a third-party rate provider returning wrong data. Those are consumed and attributed, not curated by us. Report them upstream.
• Missing corridors or missing anchors. A source Wayfare does not price yet is a feature request — open an issue.

Wayfare is non-custodial and read-only: it never issues tokens, never holds reserves, never takes possession of funds, and never signs or submits a transaction. There is no key material in the codebase and nothing to drain. If you find a code path that submits anything to the network, that is itself a critical finding — report it.