If you discover a security vulnerability in any Floe Labs repository, do not open a public issue. Instead:

1. Email: security@floelabs.xyz
2. Include: description of the vulnerability, steps to reproduce, and potential impact
3. Response time: We will acknowledge receipt within 48 hours and provide a detailed response within 7 business days

Floe's smart contracts have been audited by Omniscia:

• Floe Labs — Modular Lending Security Audit Report (November 2025)

Additional internal security reviews have been conducted for the operator delegation pattern (Upgrade #12) and the x402 facilitator (SSRF hardening, reservation state machine).

We follow responsible disclosure practices. We ask that you:

• Give us reasonable time to fix the issue before public disclosure
• Make a good-faith effort to avoid privacy violations, data destruction, and service interruption
• Do not access or modify other users' data

We will not pursue legal action against researchers who follow this policy.