Security
Report privately, never in a public issue
These are the website's main protections and the confidential way to report a problem.
Reporting
Where to send a vulnerability report
- Email: security@celoht.com
- For a sensitive issue, use the private address above and never share personal data, a private key, or a recovery phrase.
This website
Practices
- Security headers are configured for supported hosts; static hosting uses the public host policy in
public/_headers. - No secrets committed - environment variables only
- Dependency and repository security practices are documented in the public GitHub organization and repository policies.
The dApp and contracts
Practices
- OpenZeppelin’s audited AccessControl, Pausable, and ReentrancyGuard base contracts
- DonationManager’s platform fee is hard-capped at 5% directly in the contract code
- Contract deployment and test claims are maintained in the dedicated smart-contract repository, not represented as website activity.
User protection