Skip to content
Assay docs

Security policy

Assay is pre-audit and runs on Stellar testnet only. Do not rely on it to protect funds.

Reporting a vulnerability

Section titled “Reporting a vulnerability”

Report privately through GitHub’s private vulnerability reporting. Do not open a public issue, PR or discussion.

Please include affected component (registry, guard, CLI, SDK), version or commit, steps to reproduce and impact.

We aim to acknowledge within 3 business days and to agree a disclosure timeline with you. We credit reporters unless you ask us not to.

Scope

Section titled “Scope”

In scope: contracts/*, crates/assay-stellar, packages/sdk. Out of scope: contracts/demo-pool economics (it is a testnet demo), and third-party data providers.

Board · Core repo · Docs repo · GitHub organisation

Assay, by Garkuwa Labs. The board reads Stellar mainnet; Assay's contracts run on Stellar testnet and have not been audited. Figures are as stated by issuers or attestors. Assay is not an audit and not investment advice. Open source under Apache-2.0.