Trellis is a smart contract that locks and moves real funds on Stellar's Soroban platform. Vulnerabilities can directly result in loss of escrowed funds, so we take security reports seriously and ask that they be disclosed responsibly.

Only the current major version of the contract and CLI receives security fixes. Older major versions are considered end-of-life.

Please do not open a public GitHub issue for security vulnerabilities. Publicly disclosing a vulnerability before a fix is available puts funds held by the live contract at risk.

Instead, report it privately using one of these channels:

1. Preferred: Use GitHub's private vulnerability reporting for this repository — go to the Security tab → Report a vulnerability. This opens a private advisory visible only to maintainers.
2. Email: if you cannot use GitHub's reporting tool, email talk2izeek@gmail.com with a description of the issue, steps to reproduce, and its potential impact. Encrypt sensitive details if possible.

Please include as much of the following as you can:

• A clear description of the vulnerability and its impact (e.g. fund loss, unauthorized state transition, denial of service).
• Steps to reproduce, or a minimal proof-of-concept (e.g. a failing test against contracts/trellis_core).
• The affected version/commit.

• Acknowledgement: within 3 business days of your report.
• Initial assessment: within 7 days, including a severity classification and expected timeline for a fix.
• Disclosure: we will coordinate a disclosure date with you once a fix is released. Credit is given to reporters unless they prefer to remain anonymous.

We're grateful to the following researchers for responsibly disclosing security issues:

No reports yet — be the first!