Security boundaries

Accounts and wallets

Server-side account identity controls request ownership. Requests are limited to ten per account per day and votes are unique per account and request. These are account limits, not Sybil-resistant proof of unique people.

EIP-6963 wallet discovery shows the names and logos announced by installed providers. Detection is not certification of a wallet. Confirm the extension or application independently and never provide seed phrases.

Untrusted source and model output

Source repositories can contain malicious code, misleading documentation, license issues or prompt injection. The crypto filter does not certify a repository. Source is pinned and runner execution is isolated; secrets remain outside the sandbox.

Generated code can be incomplete, insecure or incorrect even when tests pass. Review all dependencies and preserve upstream notices before publication.

Funding and operator trust

Only registered router logs are imported. Settlement still relies on a trusted operator to report converted proceeds and provider credit honestly. The ledger is not a proof of the operator’s solvency or a guarantee that every external transaction has been indexed.

Fee-router source is unaudited reference code. Compilation and accounting checks are not an on-chain audit. No automatic token buyback or autonomous mainnet signing is active.

Reporting an issue

Do not publish secrets, exploit payloads against live funds, or personal data in public reports. Keep the affected URL, time, relevant transaction or job identifier, and non-sensitive reproduction steps. A dedicated operator support and security contact must be established before public operation.