If you discover a security vulnerability in any Ann Lite repository — especially anything involving authentication, donations, payments, or CeloHT integration — do not open a public issue.

Instead:

1. Report it privately to the maintainers (contact channel to be published in annlite-security).
2. Include: affected repository, a clear description, reproduction steps, and potential impact.
3. Do not publicly disclose the issue until it has been triaged and, where applicable, remediated.

We aim to acknowledge reports promptly and will keep reporters informed of remediation progress.

This policy covers all repositories in the Ann Lite organization, including but not limited to:

• annlite-backend, annlite-database
• annlite-payments, annlite-celoht
• annlite-web, annlite-admin, annlite-mobile
• annlite-infrastructure

Security fixes are applied to the current main branch of each repository. Older tagged releases are patched at maintainer discretion.

• No raw payment card data (PAN, CVV) is ever stored or logged.
• No private keys (blockchain or otherwise) are stored in source control.
• All donation and payment flows are verified server-side.
• Role-based access control gates all administrative and financial operations.
• Dependency and secret scanning run in CI (see annlite-infrastructure workflows).

For the full threat model, audit checklists, and incident response process, see the annlite-security repository.