Security
Report privately, never in a public issue
Each CeloHT repository has its own SECURITY.md — here's the summary and where to send a report.
Reporting
Where to send a vulnerability report
- Email: security@celoht.com
- Or use GitHub Security Advisories on the relevant repository’s “Report a vulnerability” page
This website
Practices
- Strict Content Security Policy and standard security headers (see next.config.ts)
- No secrets committed — environment variables only
- CodeQL static analysis and Dependabot on every change
The dApp and contracts
Practices
- OpenZeppelin’s audited AccessControl, Pausable, and ReentrancyGuard base contracts
- DonationManager’s platform fee is hard-capped at 5% directly in the contract code
- Every contract has pause/unpause gated to an admin role
- 30 passing tests across the contract suite, run on every Pull Request
Full policies