We take the security of MiLyfe seriously. If you discover a security vulnerability, please report it responsibly.

DO NOT open a public GitHub issue for security vulnerabilities.

Email: contact@milyfe.fun

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if you have one)

In scope:

• milyfe.fun (production application)
• API endpoints at milyfe.fun/api/*
• Authentication and authorization flaws
• Data exposure vulnerabilities
• Injection vulnerabilities (XSS, SQL injection, etc.)
• Business logic flaws affecting user funds ($MLY)

Out of scope:

• Denial of service attacks
• Social engineering
• Physical attacks
• Vulnerabilities in third-party services (Supabase, Vercel)
• Issues already reported and being fixed

We will not take legal action against researchers who:

• Make a good faith effort to avoid privacy violations and data destruction
• Do not exploit vulnerabilities beyond what is necessary to demonstrate them
• Report vulnerabilities promptly
• Do not publicly disclose before we've had reasonable time to fix

We recognize security researchers who responsibly disclose vulnerabilities. With your permission, we'll credit you in our changelog.

This platform implements:

• Row Level Security (RLS) on all database tables
• Rate limiting on all API routes (Upstash Redis)
• Zod input validation at every boundary
• Atomic wallet transfers (PostgreSQL transactions with row locks)
• HTML sanitization (DOMPurify) on all rich text
• CSRF protection via Origin/Referer validation
• Audit trail on sensitive operations
• End-to-end encrypted safety journal (AES-256-GCM)
• Session management with revocation capabilities
• Content reporting system

Last updated: August 2026