> ## Documentation Index
> Fetch the complete documentation index at: https://heyaven09.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Aven Security Model and Best Practices

> How Aven protects funds, work data, and identity — audit status, threat model, key custody guidance, and best practices for integrators building on the protocol.

## Design principles

* **Non-custodial.** Aven never controls user keys or funds. Every state change is signed by the user's wallet.
* **Atomic settlement.** Payment and attestation are minted in a single Soroban transaction — either both succeed or both revert.
* **Local-first privacy.** The `aven-stellar` CLI processes Git history on the worker's machine. Only aggregated statistics and hashes leave the device.

## Threat model

| Risk                                     | Mitigation                                                                          |
| ---------------------------------------- | ----------------------------------------------------------------------------------- |
| Client refuses to pay after work is done | Funds are pre-escrowed in the Stream contract; workers claim atomically.            |
| Worker fabricates session data           | Reports are signed and pinned to a Git commit hash chain, verifiable by the client. |
| Compromised wallet                       | Users control custody; Aven recommends hardware wallets for Mainnet.                |
| Contract bug                             | Contracts are open source; independent audit precedes Mainnet launch.               |

## Best practices for integrators

<Steps>
  <Step title="Verify contract IDs">
    Never hardcode addresses without cross-checking the [Contract Addresses](/developers/contract-addresses) page.
  </Step>

  <Step title="Simulate before signing">
    Use `simulateTransaction` to preview outcomes and surface human-readable diffs to your users.
  </Step>

  <Step title="Handle failures gracefully">
    Because payout and attestation are atomic, a failed transaction leaves state untouched — retry safely.
  </Step>

  <Step title="Rate-limit reputation queries">
    `compute_score` is a view function but still consumes RPC quota; cache results client-side.
  </Step>
</Steps>

## Reporting a vulnerability

Email `security@aven.xyz` with a proof-of-concept. Responsible disclosures qualify for the Aven bug bounty program.

<Card title="Read the source" icon="github" href="https://github.com/aven-stellar">
  All contracts, the dashboard, and the CLI are open source and MIT-licensed.
</Card>