The Nevo team and community take the security of our application, backend services, and smart contracts very seriously. We appreciate responsible security research and disclosure.

We actively support and maintain the latest release of Nevo on the main branch. Security fixes will be applied to the current active components:

Please do not report security vulnerabilities through public GitHub issues.

If you discover a security vulnerability in Nevo (including frontend, backend authentication/authorization, or Soroban smart contracts), please disclose it responsibly using one of the following private methods:

Submit a private security advisory directly via GitHub:

1. Navigate to the repository's Security tab.
2. Select Advisories and click Report a vulnerability.
3. Fill out the details including proof of concept, impact, and steps to reproduce.

If GitHub Private Vulnerability Reporting is unavailable, please reach out directly to the maintainers:

• Contact Maintainer: @Akshola00

To help us evaluate and address the issue efficiently, please include as much of the following as possible:

• Type of issue: (e.g. smart contract reentrancy/logic flaw, backend auth bypass, XSS, API key leakage, etc.)
• Affected component(s): (nevo_frontend, nevo_server, or nevo_contract)
• Detailed steps to reproduce or a minimal Proof of Concept (PoC)
• Potential impact of the vulnerability
• Any suggested fixes or mitigations (optional)

1. Acknowledgment: We aim to acknowledge receipt of your vulnerability report within 48 hours.
2. Assessment: Our maintainers will investigate and verify the report.
3. Fix & Patching: We will work on a patch and notify you when a fix is ready for testing/verification.
4. Public Release: Once the patch is merged and deployed, we will coordinate public disclosure if appropriate and give proper credit to the reporter (unless anonymity is requested).

Thank you for helping keep Nevo and the Stellar ecosystem safe!