Security
How to report a vulnerability in Periplo, and what the design already protects against.
Reporting a vulnerability
Report vulnerabilities privately through GitHub's private vulnerability reporting. Only the maintainers see the report until an advisory is published. Please do not open public issues with exploit details.
Report privately through GitHub
What the design protects against
- The facilitator refuses to start if its key could move users' assets.
- It is never the source, operation source or signer of a buyer's payment; it only pays the network fee.
- With upto, the buyer's signature covers a ceiling, and the contract rejects any settlement above it.
- Every rejected payment returns an explicit reason.