Security
Report privately, never in a public issue
Voici les protections principales du site et la manière confidentielle de signaler un problème.
Reporting
Where to send a vulnerability report
- Email: security@celoht.com
- Pour un problème sensible, utilisez l'adresse privée ci-dessus et ne partagez jamais de données personnelles, de clé privée ou de phrase de récupération.
This website
Practices
- Strict Content Security Policy and standard security headers (see next.config.ts)
- No secrets committed - environment variables only
- CodeQL static analysis and Dependabot on every change
The dApp and contracts
Practices
- OpenZeppelin’s audited AccessControl, Pausable, and ReentrancyGuard base contracts
- DonationManager’s platform fee is hard-capped at 5% directly in the contract code
- Every contract has pause/unpause gated to an admin role
- 30 passing tests across the contract suite, run on every Pull Request
Protection des utilisateurs