This repository is a style guide. It does not ship deployable contracts. "Security issues" here mean:
- A rule that would lead developers to write insecure code.
- A code example that compiles to a vulnerable pattern.
- A link that redirects to a malicious resource.
- Supply-chain risk in
package.jsondevDependencies.
Do not open a public issue for security-relevant corrections. Instead:
- Email:
boudjemaa.adam@gmail.com - Or: open a private security advisory via GitHub's Security → Advisories → Report a vulnerability on this repo.
Please include:
- Section / rule name
- Why the current guidance is unsafe (cite EIP / CVE / audit when relevant)
- Suggested replacement text
- Your contact + whether you want public credit
| Severity | Triage | Fix |
|---|---|---|
| Critical (guidance leads to fund loss) | 24h | 72h |
| High (guidance enables known vuln class) | 72h | 1 week |
| Medium / Low | 1 week | Best effort |
We coordinate disclosure with reporters. Public acknowledgement is in CHANGELOG.md and the release notes unless you ask to stay anonymous.
- Style disagreements without a security angle (open a regular PR).
- Typos (open a PR).
- Tool versions behind "latest" (open a PR).