# XLMarket — security contact
# https://securitytxt.org/

Contact: mailto:hello@xlmarket.io
Preferred-Languages: en
Canonical: https://xlmarket.io/.well-known/security.txt
Expires: 2027-09-02T00:00:00.000Z

# Please report vulnerabilities privately to the address above before any public
# disclosure, and give us a reasonable window to ship a fix.
#
# In scope:   xlmarket.io and its API, and the Soroban bonding-curve contract.
# Out of scope: denial-of-service, volumetric/automated scanning, social
# engineering, and third-party services we merely link to (e.g. the swap widget).
#
# This platform runs on the Stellar PUBLIC network (mainnet). Findings involve real funds.
# carry no real value. Please do not test against anyone's mainnet funds.
#
# We do not run a paid bug-bounty yet, but we will credit reporters who want it.