Torrent is an unaudited prototype for Stellar Testnet with synthetic funds. It is not deployed to Mainnet and must not be used with anything of value. We still take reports seriously: they shape what has to be true before any real use.
Only the latest commit on main is supported. There are no releases yet.
Please do not open a public issue, discussion or pull request for a vulnerability.
- Use GitHub's private reporting: Report a vulnerability (Security tab -> Advisories).
- If that form is unavailable, open a public issue titled "Security contact request" with no details, and a maintainer will arrange a private channel.
Include the affected repository and commit, the impact (for example: a right issued without backing, a claim by a non-owner, a double claim, a signing request that differs from what the user approved), and reproduction steps, ideally a failing test.
We aim to acknowledge reports within 5 working days and to agree on a disclosure timeline with you. There is no bug bounty.
In scope: code in this repository and its interaction with the sibling repositories (Torrent-contracts, Torrent-indexer, Torrent-api, Torrent-web).
Out of scope: findings that require Mainnet funds (none are supported), third-party services, and social engineering.
Never include real secret keys, seed phrases or personal data in a report. The threat model is in docs/SECURITY.md.