> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mystockline.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Security and audits

> Audits, bug bounty, and access controls.

Stockline's core is immutable once deployed. Treat it as unreviewed until an audit PDF is linked here.

No report is published. The contracts README status is pre-audit. Two audits are in the launch plan. This page will link the PDFs when they exist. Do not write audited in a client until those links are live.

No bug bounty program is open. Scope and rewards will appear in this table.

| Severity   | Reward      | Status |
| ---------- | ----------- | ------ |
| Critical   | unpublished | closed |
| High       | unpublished | closed |
| Medium     | unpublished | closed |
| Low / info | unpublished | closed |

Expected scope when it opens: `src/core`, `src/oracles`, `src/governance`, `src/periphery`, `src/token`. Out of scope: `src/testnet`, third-party tokens, Pons STK, Chainlink feeds.

Email [security@mystockline.xyz](mailto:security@mystockline.xyz). Include a PoC against the tagged contracts, the network, and the impact. Do not open a public GitHub issue for a live fund-risk bug.

What to reason about today: action table vs `EquityOracle.regime()`, liquidation sizing and the unenforced allowlist flag, FeeCollector waterfall and buy-and-burn bounds, Zap and PositionRouter zero-balance invariant, Guardian cannot pause repay or `supplyCollateral`.

Related: [Access controls](/resources/access-controls), [Risks](/resources/risks), [Governance](/concepts/governance).

The core has no admin functions and no proxies. Parameter writes go through owner, which should be the timelock. Guardian is a pause key on Stockline only. Access controls lists every privileged function the scanner found.

Until audits land, treat every integration as pre-audit. Caps, the allowlist flag (unenforced), and thin exit depth are the live risk controls. See Risks.

Disclosure contact is the only channel for fund-risk bugs. The bounty table stays closed until rewards are published.