Merge branch 'develop' into docs/nuxt-integration-guide

Author: temieehade-coder

.github/workflows/retarget-pr-main.yml

@@ -0,0 +1,26 @@
+name: Retarget PRs against main
+
+on:
+  pull_request_target:
+    types: [opened, reopened]
+    branches: [main]
+
+permissions:
+  pull-requests: write
+  issues: write
+  contents: read
+
+jobs:
+  retarget:
+    # Skip release PRs (develop -> main); catch everything else that targets main.
+    if: github.event.pull_request.head.ref != 'develop'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Retarget to develop and comment
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR=${{ github.event.pull_request.number }}
+          REPO=${{ github.repository }}
+          gh pr edit "$PR" --repo "$REPO" --base develop
+          gh pr comment "$PR" --repo "$REPO" --body "Auto-retargeted this PR from \`main\` to \`develop\`. Wave PRs merge into \`develop\`; \`main\` is only for release cuts. If you meant to target main deliberately (rare), reply here and we can revert this."

SECURITY.md

@@ -0,0 +1,43 @@
+# Security
+
+Wraith Protocol handles stealth-address key material and private payments across multiple blockchains. We take security seriously and welcome responsible disclosure from the security community.
+
+## Reporting a Vulnerability
+
+**Email:** security@usewraith.xyz
+
+Please do **not** open a public GitHub issue, post on social media, or discuss the finding publicly until a fix has shipped and coordinated disclosure has been agreed with us.
+
+If your report contains sensitive proof-of-concept material, use PGP. Our public key is at https://usewraith.xyz/.well-known/security.txt.
+
+## Response
+
+| Milestone | Target |
+|---|---|
+| Acknowledgment | 1 business day |
+| Initial triage | 3 business days |
+| Fix timeline communicated | 7 business days |
+| Patch for critical / high | 14 days |
+| Patch for medium | 45 days |
+| Patch for low | 90 days |
+
+## Safe Harbor
+
+We will not pursue legal action against researchers who discover and report vulnerabilities in good faith under this policy. We consider good-faith security research under this policy to be authorized and will not treat it as a violation of our terms of service.
+
+## Rewards
+
+We operate a discretionary USDC bug bounty:
+
+| Severity | Range |
+|---|---|
+| Critical | $5,000 – $20,000 |
+| High | $1,000 – $5,000 |
+| Medium | $250 – $1,000 |
+| Low | $0 – $250 |
+
+## Full Policy
+
+Complete details — scope, severity definitions, coordinated disclosure terms, safe-harbor language, reward criteria, and what to include in a report — are in our security disclosure policy:
+
+**https://docs.usewraith.xyz/reference/security-disclosure**