If you discover a security vulnerability in SorobanTrace, please report it responsibly.

Do NOT open a public issue for security vulnerabilities.

Instead, please email: [security@sorobantrace.dev] (placeholder)

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Initial assessment: Within 1 week
• Fix timeline: Depends on severity

SorobanTrace is a developer tool for inspecting transactions. It does not:

• Handle private keys
• Sign transactions
• Manage funds
• Store sensitive data

However, we take security seriously because:

• Users may paste transaction data containing sensitive information
• The tool interacts with blockchain networks
• Incorrect error handling could expose system information

1. No secret logging: Never log private keys, seeds, or sensitive data
2. Input validation: Validate all external input
3. Error handling: Don't expose internal system details in errors
4. Dependencies: Keep dependencies updated
5. Minimal permissions: Request only necessary permissions

We use:

• cargo audit to check for known vulnerabilities
• Automated dependency updates
• Minimal dependency surface area

For security concerns, contact the maintainers directly.