Skip to content

Security: powerchain-protocol/payment-platform

Security

SECURITY.md

Security Policy

Reporting a vulnerability

Do not disclose exploitable vulnerabilities in a public issue. Report them privately to the PowerChain security contact configured by the project owner. Include affected files, reproduction steps, impact, and a suggested remediation when available.

High-risk areas

  • Merchant and mint signing keys
  • Token-2022 authorities and transfer-fee configuration
  • Solana Pay reference, amount, recipient, and mint validation
  • Supabase service credentials and row-level-security policies
  • Prisma database credentials and migrations
  • Sui bridge capabilities and replay protection

Operational requirements

Never expose SUPABASE_SECRET_KEY, DATABASE_URL, DIRECT_URL, merchant keypairs, or fee-authority keypairs to browser bundles. Production signing should use managed custody, KMS/HSM, or multisig controls. Validate every payment server-side before fulfillment and require idempotent order claiming.

Supported versions are the current default branch and the latest tagged release.

There aren't any published security advisories