The absence of a published audit means users should not assume the contracts or application have received an independent security review. An audit also does not eliminate risk.
The application includes exact-amount validation, chain and recipient checks, confirmed-transaction requirements, payment replay controls, creator signatures, encrypted storage, and production disabling of demo proofs.
A dedicated security contact and disclosure policy have not been added yet. Before production launch, publish a monitored email address, expected response window, safe-harbor language, eligible systems, and rules for handling sensitive reports.
