AssetFare never receives private keys and never signs or submits a transaction. Report an unpatched vulnerability privately; do not post secrets or exploit details in a public issue.
Email security@assetfare.dev or use the GitHub private vulnerability reporting form. Include affected URLs or versions, impact, reproduction steps, and a minimal proof of concept.
Never include a private key, seed phrase, bearer token, signed transaction, or personal data. Revoke or rotate any credential that may have been exposed and provide only a redacted identifier.
Every v2 quote carries a fail-closed direct_route_summary binding the requested intent to its ordered provider path, normalized endpoints, amount continuity, exact 1bp fee step, and no-sign/no-submit flags. Every current public route is direct_protocol_only; external_intent remains only as a compatibility enum. route_aggregator_used=false is scoped to AssetFare's engine.
Publishing security.txt does not grant authorization to test systems or funds.
Every public route declares an exact 1 basis point AssetFare service fee, rounded down in asset base units, with no service-fee maximum and no zero-fee route. The caller must independently verify the fee basis and unsigned action before signing: $100,000 corresponds to a $10 AssetFare fee and $1,000,000 to $100. Circle, provider, protocol, and network fees are separate costs and must also be checked in the quote's total token-path cost.
Reports may cover the public route API, remote MCP compatibility adapter, machine-readable discovery artifacts, and caller-signed workflow. AssetFare does not currently operate a bug-bounty program or promise a response time. Good-faith reports will be reviewed as operational capacity permits.
Email support@assetfare.dev or use public GitHub issues only for non-sensitive product defects and documentation questions.