Provance handles real money. We take security seriously and we want to know about problems before they affect users.
Do not open a public GitHub issue for security vulnerabilities.
Email us at security@provance.xyz with:
- A description of the vulnerability
- Steps to reproduce it
- What you think the impact is
We will respond within 48 hours and keep you updated as we work on a fix.
The things we care most about:
- The Soroban savings vault contract (
provance-contracts) - Anything that could allow funds to be moved without the depositor's authorisation
- Key management and wallet handling
Please give us time to fix the issue before disclosing it publicly. We will credit you if you want.