Security Policy

Last updated: 22 June 2026

1. Reporting a vulnerability

DO NOT create a public GitHub issue or post on social media. Send vulnerability reports privately to security@zephyros.cash. Include a description, steps to reproduce, potential impact, and a suggested fix if you have one.

2. Our commitment

We will acknowledge your report within 4 hours, provide a status update within 1 day, and aim to fix critical issues within 3 days. We will credit researchers who report responsibly (if desired) and disclose the issue publicly once a fix is shipped.

3. What we ask

Keep the vulnerability confidential until we publish a fix. Give us up to 7 days depending on severity before any public disclosure. Avoid automated scanning tools or mass testing against production. Use private email — not public channels.

4. Technical security

Zephyros uses Groth16 zero-knowledge proofs generated in-browser and verified on-chain by the Anchor program running on Solana. All transaction amounts are enforced by the on-chain program, making counterfeit tokens impossible. We use standard SPL token contracts to minimise custom code risk. The full source code is available at github.com/Blue8x/Zephyros.

5. Audit report

An internal security audit was conducted covering the Groth16 circuit, the Anchor program, Merkle proof verification, nullifier mechanism, and amount enforcement. No critical vulnerabilities were found. The full audit report is available in AUDIT_REPORT.md.

6. Limitations

Zephyros is provided "as is" without warranty. We cannot guarantee the code is bug-free or perfectly secure. Private keys are your responsibility to protect. Start with small amounts when testing. Always verify transaction details before confirming.

7. Previous issues

Security advisories will be published here as they are resolved. Subscribe to GitHub releases for updates.