There are no supported production releases yet. This repository contains M0 contracts and a local reference model. Do not place it in front of production traffic.

Do not publish exploit details, credentials or customer data in public issues. A private reporting contact and response policy must be configured before the first public release; that requirement remains a release blocker. Once a hosted repository supports private vulnerability reporting, use its Security tab.

Track security boundaries and planned verification in the threat model.