If you discover a security vulnerability, please report it responsibly:

1. Do not open a public issue
2. Email the report to arxia.network@proton.me
3. Include steps to reproduce the vulnerability
4. Allow reasonable time for a fix before public disclosure

Security issues in the following areas are in scope:

• Cryptographic code (Ed25519 signatures, Blake3 hashing; ChaCha20-Poly1305 and SLIP39 are stubs that return Unimplemented)
• Consensus logic (ORV, conflict resolution, quorum)
• Double-spend detection
• Gossip protocol integrity
• Example contract logic in contracts/ (no contract runtime or sandbox exists)
• Key management and storage

ERC-20 token contract audited by SolidProof, zero findings. The protocol, bridge, wallet and embedded code have not been audited yet.

The CRIT-, HIGH-, MED- and LOW- identifiers in code comments refer to an internal security review, not an external audit. See docs/SECURITY_REVIEW.md.