Do NOT open a public GitHub issue for security vulnerabilities.

1. Email: Send findings to security@aastar.io (or create a private GitHub Security Advisory)
2. Include:
   • Contract(s) affected
   • Description of the vulnerability
   • Proof of concept (test case or transaction trace)
   • Estimated severity (Critical/High/Medium/Low)
3. Response time: We aim to respond within 48 hours and provide a fix timeline within 7 days for Critical/High findings

• Smart contract vulnerabilities (fund loss, unauthorized access, bypass of security controls)
• Logic errors in tier enforcement, guardian recovery, or session key validation
• Cross-chain replay attacks or signature malleability issues

The following are known design trade-offs and are NOT considered vulnerabilities:

• EIP-7702 private key permanence: If an EOA private key is compromised, the attacker can reset the delegation. Users are advised to migrate to native AirAccountV7 for high-value accounts.
• Guardian self-dealing after trust is established: Once a guardian is set, they can participate in recovery. Users should only set trusted parties as guardians.
• Tier enforcement depends on tier1Limit/tier2Limit being set: If not configured, all transactions default to Tier 0 (no tier restriction).

A formal bug bounty program is planned via Immunefi after the M7 professional audit completes.

Proposed rewards (subject to change after audit):

• docs/2026-03-20-audit-report.md — Internal security review, M6
• docs/M6-security-review.md — M6 internal security review

External professional audit in progress (M7.6 — CodeHawks).