AirFlex handles real user funds through Stellar-backed escrow contracts and Paystack payment integrations. We take security seriously and are committed to working with the security community to resolve vulnerabilities responsibly.

Do not open a public GitHub issue for security vulnerabilities.

Use one of the following private channels, in order of preference:

GitHub Security Advisories are preferred: the report, discussion and eventual fix stay in one private thread, and the advisory becomes the public record once disclosure is permitted.

Encrypt sensitive reports with our PGP key (available on request via the email above) if they contain credentials, exploit code, or private user data.

A high-quality report helps us triage and fix issues faster. Please include:

• Description — what the vulnerability is and why it is exploitable
• Affected component — API endpoint, contract function, auth flow, etc.
• Steps to reproduce — curl commands, scripts, or a minimal proof-of-concept
• Impact assessment — what an attacker could achieve
• Suggested fix (optional but appreciated)

All times run from the moment your report is received on one of the channels above. "Business days" are Monday–Friday, excluding Nigerian public holidays.

Measured from the end of triage.

If an SLA will be missed — for example, a contract fix that needs redeployment and an audit — we tell you before the deadline, explain why, and give a new date.

If you have not received an acknowledgement within 48 hours, please follow up at security@airflex.io.

We follow coordinated disclosure. The timeline is:

1. Day 0 — report received; acknowledgement within 48 hours.
2. Within 5 business days — triage complete and severity agreed with you.
3. Within the resolution SLA — fix deployed; we confirm with you that it resolves the issue.
4. Fix + 7 days — a GitHub Security Advisory (and CVE where applicable) is published, crediting you if you wish. The 7-day buffer lets operators and integrators update.

Public disclosure is permitted once the earliest of the following occurs:

• the GitHub Security Advisory for the issue has been published; or
• 90 days have passed since the report was received, regardless of fix status, unless both parties agree in writing to an extension; or
• the vulnerability is already being actively exploited or has been publicly disclosed by a third party — in which case we will publish an advisory as soon as a mitigation is available and you may disclose at the same time.

Please do not disclose details (including to other parties) before one of these conditions is met.

The following are not eligible for the responsible disclosure programme:

• Vulnerabilities in third-party dependencies not introduced by AirFlex code (report those directly to the upstream maintainer)
• Test / staging environments and demo data
• Denial-of-service attacks requiring significant infrastructure resources
• Social engineering or phishing attacks against AirFlex staff
• Missing security headers that do not lead to a practical exploit
• Rate limiting on non-sensitive endpoints
• Theoretical vulnerabilities without a working proof-of-concept

We will not pursue legal action against researchers who:

• Discover and report vulnerabilities in good faith
• Do not access, modify, or exfiltrate real user data beyond what is necessary to demonstrate the vulnerability
• Do not perform destructive testing (deleting data, disrupting service)
• Do not disclose the issue publicly before it is permitted under Coordinated Disclosure

We use the CVSS v3.1 scoring system combined with the following business-impact guidelines:

We credit researchers who responsibly disclose valid security issues. With your permission, your name (or handle) will appear in the published security advisory.

Thank you for helping keep AirFlex and its users safe.