The Willi-Mako Client SDK is currently in active development. We aim to support the latest minor release of the willi-mako-client package and the previous minor release. Security fixes are applied to the most recent version and published via npm.

We take the security of STROMDAO infrastructure and the energy market ecosystem seriously. If you discover a vulnerability:

1. Do not create a public GitHub issue.
2. Email the security team directly at dev@stromdao.com with the subject line SECURITY ISSUE: Willi-Mako Client SDK.
3. Provide the following details:
   • A description of the vulnerability and potential impact
   • Steps to reproduce or proof-of-concept code
   • Any logs, stack traces, or screenshots that help explain the issue
   • Your assessment of the severity (if possible)
   • Contact information so we can reach you for additional details

We will acknowledge receipt of your report within 72 hours and work with you on a remediation plan. You will be kept informed of progress and notified when a fix is available.

• We request that you withhold public disclosure of the vulnerability until a fix is released.
• Once a fix is published, we will credit researchers who responsibly reported the issue unless you prefer to remain anonymous.
• For critical vulnerabilities affecting broader STROMDAO systems, coordinated disclosure may be required—including communication with energy market partners and regulatory bodies.

This policy applies to the contents of this repository and the published willi-mako-client npm package. If you uncover issues in other STROMDAO products or infrastructure, please still notify us; we will route the report to the appropriate team.

If you need to send encrypted communications, request our PGP public key via dev@stromdao.com and we will provide it securely.

We appreciate responsible security research and will make every effort to work cooperatively with researchers to keep the Willi-Mako ecosystem safe for all market participants.