Sorochain takes security seriously. If you discover a vulnerability, do not open a public GitHub issue.

1. Email security@sorochain.dev with the subject line [SECURITY] <brief description>.
2. Include:
   • A clear description of the vulnerability.
   • Steps to reproduce.
   • Potential impact assessment.
   • Any suggested mitigations (optional but appreciated).
3. You will receive an acknowledgement within 48 hours.
4. We aim to triage and patch critical issues within 7 days.

Projects that have undergone a third-party audit and wish to disclose findings can use the same email channel. Attach the audit report and we will coordinate a coordinated disclosure timeline.

In scope:

• Smart contract logic (Soroban WASM)
• Backend API endpoints (/server)
• Wallet integration and key handling
• Bridge relayer logic

Out of scope:

• Third-party dependencies (report upstream)
• Denial-of-service via resource exhaustion without a clear exploit path

• Never commit .env files or private keys to version control.
• Rotate SOROBAN_RPC_URL credentials regularly.
• Restrict CORS_ALLOWED_ORIGINS to known frontend origins.
• Run the backend behind a reverse proxy (nginx/Caddy) with TLS in production.
• Use a dedicated, low-privilege MongoDB user for MONGO_URI.