ClearLedger is currently in active development and deployed on Stellar testnet only. No mainnet deployment exists. Smart contracts have not undergone a formal audit.

ClearLedger is split across two repositories, each with its own security scope:

• This repository (ClearLedger-app) covers the web frontend (apps/web), the indexer/API (indexer/), and the SDK (packages/sdk).
• ClearLedger-contract covers the Soroban smart contracts (registry, invoice, escrow, pool). Report smart contract vulnerabilities there — see that repository's SECURITY.md for its reporting process.

The following are in scope for security reports in this repository:

• Authentication bypass or unauthorized access in the indexer/API
• Frontend issues that could cause users to sign unintended transactions
• SDK bugs that produce incorrect transaction construction or signing
• Indexer bugs that misreport on-chain state

The following are out of scope for this repository:

• Smart contract logic errors — report to ClearLedger-contract
• Stellar protocol-level issues (report to SDF directly)
• Freighter wallet vulnerabilities (report to Freighter team)
• Testnet-only issues with no mainnet impact path
• UI cosmetic bugs

Do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities through the private reporting option in this repository’s Security tab.

Include in your report:

• Description of the vulnerability
• Steps to reproduce
• Affected repository and component (e.g. apps/web, indexer/, packages/sdk)
• Potential impact
• Suggested fix if you have one

ClearLedger follows coordinated disclosure. We ask that you give us reasonable time to assess and address a vulnerability before public disclosure.

We will credit researchers who report valid vulnerabilities in our changelog unless they prefer to remain anonymous.

The ClearLedger-contract smart contracts have not been formally audited. Users interact with testnet contracts at their own risk. A security audit is planned prior to any mainnet deployment.

ClearLedger is experimental software. Do not deposit real funds. All contracts operate on Stellar testnet with test USDC only.