> ## Documentation Index
> Fetch the complete documentation index at: https://docs.istravex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> How to report a vulnerability in Istravex, and how Istravex discloses what it finds in other projects.

Istravex exists to find defects in software that reads the Stellar ledger. Some of those defects can be exploited: a single cheap transaction halted wallet-backend's ingestion until [#753](https://github.com/stellar/wallet-backend/pull/753) fixed it. So the policy covers both directions. The full text is [`SECURITY.md`](https://github.com/hackcat29/istravex/blob/main/SECURITY.md).

## Reporting a vulnerability in Istravex

Report it privately through GitHub: **Security → Report a vulnerability** on [hackcat29/istravex](https://github.com/hackcat29/istravex/security). Private vulnerability reporting is on. Please don't open a public issue.

| Step | Target |
| - | - |
| Acknowledge | 3 business days |
| Confirm or rule out, with a severity | 7 days |
| Fix released, or mitigated on the hosted services | 30 days for high or critical; otherwise the next release |
| Public advisory, crediting the reporter if they wish | When the fix ships |

In scope: the kit, the API and mock RPC (and their hosted instances), the site, the docs build, the GitHub Action and reusable workflow, and release artefacts. A wrong fixture is a bug, not a vulnerability: open a normal issue.

## How findings in other projects are disclosed

Every finding is triaged on the [severity scale](https://docs.istravex.com/project/findings.md#severity) first.

* **Exploitable by a third party, or high or critical** (anything that halts or corrupts ingestion, mis-attributes funds, crashes a node or a decoder, or bypasses validation): reported **privately** first. For SDF projects (stellar-core, the SDKs, stellar-etl, wallet-backend), that's the [SDF bug bounty program](https://stellar.org/grants-and-funding/bug-bounty), which their own security policies point to. For other projects, their security policy or GitHub private vulnerability reporting. The reproducing fixture and the finding stay out of the public corpus until a fix ships or 90 days pass.
* **Low severity or informational, not exploitable**: a public issue, linked to its fixture.

Each finding records how it was disclosed in its `disclosure` field: `already-public`, `public-issue`, `private-then-public`, `private-embargoed` or `not-disclosed`.

## Record so far

No private disclosure has been needed yet:

* F-0001 to F-0009, F-0016 to F-0019 reproduce defects already public upstream.
* F-0010 to F-0012 were filed as public issues on 15 November 2026: they're low severity and affect reproducibility and SDK ergonomics, not validation, funds or availability.
* F-0013 to F-0015 are latent or by design.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.