At SantaFi, we take security seriously. This document outlines our security practices and how to report vulnerabilities.

• ✅ We NEVER store private keys
• ✅ We NEVER request seed phrases
• ✅ We NEVER access your wallet without explicit permission
• ✅ All transactions require YOUR approval in your wallet

• ✅ We only store public wallet addresses
• ✅ We track usage count for credit system
• ✅ We do NOT store personal information
• ✅ We do NOT sell or share your data

• ✅ All SOL transfers go to verified treasury wallet
• ✅ All transactions are on-chain and verifiable
• ✅ No hidden fees or unauthorized transfers
• ✅ You maintain full custody of your assets

{
  "wallet_address": "ABC...XYZ",  // Public information
  "connected_at": "timestamp"      // For session management
}

{
  "wallet_address": "ABC...XYZ",
  "transaction_signature": "...",  // Public, on-chain
  "credits_purchased": 50,
  "timestamp": "..."
}

{
  "wallet_address": "ABC...XYZ",
  "used_count": 1,                 // Increment counter
  "timestamp": "..."
}

We do NOT collect:

• ❌ Private keys
• ❌ Seed phrases
• ❌ Email addresses (unless you provide for support)
• ❌ IP addresses (beyond standard server logs)
• ❌ Browser fingerprints
• ❌ Your generated images (processed in memory, not stored)

• ✅ Helius RPC: Enterprise-grade Solana RPC with 99.9% uptime
• ✅ Supabase: SOC 2 Type II certified database
• ✅ Vercel: Edge network with DDoS protection
• ✅ HTTPS: All traffic encrypted with TLS 1.3

• ✅ TypeScript: Type-safe code to prevent runtime errors
• ✅ Input Validation: All user inputs sanitized
• ✅ Rate Limiting: Protection against abuse
• ✅ Environment Variables: Secrets never in code

• ✅ Standard Wallet Adapter: Using official Solana wallet adapter
• ✅ No Custom Signing: We don't implement custom transaction signing
• ✅ User Approval: Every transaction requires explicit user approval
• ✅ Transaction Transparency: All transaction details visible before signing

We appreciate responsible disclosure of security vulnerabilities.

Preferred Method:

• 📧 Email: security@santafi.xyz
• 🔒 Use PGP if sensitive (key available on request)

Alternative:

• 🐦 Twitter DM: @SantaFiXYZ
• 💬 Discord: DM to @admin (coming soon)

Please provide:

1. Description of the vulnerability
2. Steps to reproduce the issue
3. Potential impact assessment
4. Suggested fix (if you have one)
5. Your contact info for follow-up

• ⏱️ Initial Response: Within 48 hours
• 🔍 Investigation: We'll verify and assess the issue
• 🛠️ Fix: Critical issues patched within 7 days
• 🎁 Recognition: Public acknowledgment (if you want)
• 💰 Bounty: Case-by-case basis for critical findings

We follow responsible disclosure practices:

• ✅ We won't take legal action against good-faith security research
• ✅ We'll work with you to understand and fix the issue
• ✅ We'll keep you updated on our progress
• ✅ We'll publicly acknowledge your contribution (with permission)

• ✅ Give us reasonable time to fix before public disclosure
• ✅ Don't exploit the vulnerability beyond proof-of-concept
• ✅ Don't access or modify user data
• ✅ Don't perform DoS attacks

• ✅ Code review completed: December 2024
• ✅ Wallet integration verified
• ✅ Payment flow tested
• ✅ No private key storage confirmed

• ⏳ Planned for Q1 2025
• 📋 Scope: Wallet integration, payment flow, smart contracts (if any)

• ⏳ Coming soon
• 💰 Rewards based on severity
• 📜 Terms to be announced

1. ✅ Use Hardware Wallet: Ledger or similar for large amounts
2. ✅ Verify Transactions: Always check transaction details before signing
3. ✅ Check URLs: Ensure you're on santafi.xyz (not phishing site)
4. ✅ Keep Software Updated: Update your wallet extension regularly

🚩 NEVER share your seed phrase - we will NEVER ask for it 🚩 NEVER sign transactions you don't understand 🚩 NEVER connect to suspicious websites 🚩 NEVER download wallet software from unofficial sources

1. 🛑 Stop immediately - Don't proceed with the transaction
2. 📧 Contact us - security@santafi.xyz
3. 🔒 Disconnect wallet - Revoke connection if needed
4. 🐦 Report - Help protect the community

• 📧 Email: security@santafi.xyz
• 🐦 Twitter: @SantaFiXYZ
• ⏱️ Response Time: Within 48 hours

• 🌐 Website: santafi.xyz
• 💬 Community: Discord (coming soon)

This security policy may be updated periodically. Major changes will be announced via:

• 🐦 Twitter @SantaFiXYZ
• 📧 Email (if you're subscribed)
• 🌐 Website announcement

Last Updated: December 22, 2024