Kivuli for Stellar is a self-custodial privacy wallet running on Stellar testnet. It has not had an external audit yet. Treat every report accordingly: we would rather hear about a false alarm than miss a real one.

Do not open a public issue. Instead, use one of:

• GitHub's private vulnerability reporting on this repository (Security → Report a vulnerability), preferred when available.
• Email support@kivuli.xyz with SECURITY at the start of the subject.
• The contact page at https://kivuli.xyz/contact, marked as a security report.

Include what you can: affected version (Settings → About), steps to reproduce, impact as you understand it, and any proof-of-concept. Reports in plain language are fine; you do not need a CVSS score to be taken seriously.

• Acknowledgment within 3 business days.
• An assessment and a plan (or honest questions) within 10 business days.
• Coordinated disclosure: we ask for up to 90 days before public details, less if a fix ships sooner. We will credit you in the release notes if you want credit, and stay silent about you if you do not.

There is no bug bounty program yet. We say this up front so nobody invests time expecting one; serious reports are still deeply appreciated and credited.

In scope:

• The extension itself: src/ (service worker, provider bridge, UI), the build and packaging pipeline (scripts/, .github/workflows/), and the release artifacts.
• The test bench (demo/), especially anything that could mislead a tester about what a page can see or spend.

Out of scope, report upstream instead:

• The @opaquecash/stellar SDK and the Opaque protocol contracts it targets (report to opaquecash/stellar; a heads-up to us is welcome).
• The Stellar network, Horizon, or Soroban RPC themselves.
• Chrome itself, or issues requiring a compromised browser or OS.

The wallet's threat model in one paragraph: the 12-word phrase is the root of everything; the master secret exists only in service-worker memory while unlocked; the vault, scan cache, and origin map are encrypted at rest; each dApp origin gets an isolated account, and stealth notes are spendable only through keys reconstructed from the seed. A finding that breaks any of those properties is exactly what this policy is for.

Use throwaway wallets and testnet funds (friendbot is free) for research. Never ask users for their recovery phrase or passcode as part of a demonstration; support will never ask for either, and neither should a researcher.