Adaptive Yield is experimental, unaudited, and not production-ready. No bug bounty exists. Do not use it to manage funds you cannot afford to lose.

Please do not disclose suspected vulnerabilities in a public issue. Until a dedicated encrypted reporting channel is published, contact the repository owner privately through the verified contact method on their GitHub profile and include the affected commit, impact, reproduction, and any suggested mitigation. Do not test against mainnet assets or third-party systems without authorization.

The project makes no promise of response time, reward, or safe-harbor program. Reports will be assessed in good faith. Security-relevant assumptions and known residual risks are documented in docs/THREAT_MODEL.md.