Soroban Guard is in active pre-1.0 development. Security fixes are applied to
the main branch and shipped as tagged releases.
| Version | Supported |
|---|---|
| 0.1.x | ✅ |
| < 0.1 | ❌ |
Please do not open a public issue for security vulnerabilities in Soroban Guard itself.
Report them privately using GitHub's private vulnerability reporting ("Report a vulnerability"), or by contacting the maintainers directly.
Include:
- A description of the vulnerability and its impact
- Steps to reproduce, including affected source files or a sample contract
- The affected version(s)
- A suggested fix, if you have one (optional)
This policy covers vulnerabilities in Soroban Guard itself, for example:
- A false negative — the analyzer misses a class of real smart-contract vulnerability (e.g. a reentrancy or overflow pattern it should flag).
- A crash, panic, or denial-of-service when parsing untrusted or malformed source.
- A bug in the report/exit-code logic that could mislead CI gating.
Findings that the tool produces about your contracts are analysis results, not vulnerabilities in Soroban Guard.
Maintainers will acknowledge reports within five business days and aim to resolve confirmed issues before the next release, coordinating public disclosure with the reporter.