Security - Istravex

Istravex exists to find defects in software that reads the Stellar ledger. Some of those defects can be exploited: a single cheap transaction halted wallet-backend’s ingestion until #753 fixed it. So the policy covers both directions. The full text is SECURITY.md.

Reporting a vulnerability in Istravex

Report it privately through GitHub: Security → Report a vulnerability on hackcat29/istravex. Private vulnerability reporting is on. Please don’t open a public issue.

Step	Target
Acknowledge	3 business days
Confirm or rule out, with a severity	7 days
Fix released, or mitigated on the hosted services	30 days for high or critical; otherwise the next release
Public advisory, crediting the reporter if they wish	When the fix ships

In scope: the kit, the API and mock RPC (and their hosted instances), the site, the docs build, the GitHub Action and reusable workflow, and release artefacts. A wrong fixture is a bug, not a vulnerability: open a normal issue.

How findings in other projects are disclosed

Every finding is triaged on the severity scale first.

Exploitable by a third party, or high or critical (anything that halts or corrupts ingestion, mis-attributes funds, crashes a node or a decoder, or bypasses validation): reported privately first. For SDF projects (stellar-core, the SDKs, stellar-etl, wallet-backend), that’s the SDF bug bounty program, which their own security policies point to. For other projects, their security policy or GitHub private vulnerability reporting. The reproducing fixture and the finding stay out of the public corpus until a fix ships or 90 days pass.
Low severity or informational, not exploitable: a public issue, linked to its fixture.

Each finding records how it was disclosed in its disclosure field: already-public, public-issue, private-then-public, private-embargoed or not-disclosed.

Record so far

No private disclosure has been needed yet:

F-0001 to F-0009, F-0016 to F-0019 reproduce defects already public upstream.
F-0010 to F-0012 were filed as public issues on 15 November 2026: they’re low severity and affect reproducibility and SDK ergonomics, not validation, funds or availability.
F-0013 to F-0015 are latent or by design.