Please report security issues privately. Do not open a public issue.

• Use GitHub's private vulnerability reporting on this repository, or
• email the maintainers (see the repository owner profile).

We aim to acknowledge reports within 3 business days and to ship a fix or mitigation for confirmed high-severity issues within 30 days.

• The identity-registry Soroban contract (packages/contracts/)
• The web application and its API (apps/web/)
• The indexer (apps/indexer/)

• SIGNET_AUTH_SECRET must be set (≥16 random chars) in production — the app refuses the dev fallback when NODE_ENV=production. Rotate it (and bump SIGNET_SESSIONS_VALID_AFTER) to revoke all sessions.
• The default rate limiter is per-instance; back it with a shared store (setRateLimitStore) for multi-instance deployments.
• Security headers (CSP, HSTS, …) are set in apps/web/next.config.js. The CSP still allows inline scripts for Next's bootstrap — tighten to nonce-based when feasible.
• The Identity Registry contract is immutable (no upgrade path) and uses a single admin key — use a multisig for the admin and audit before mainnet.