Do not open a public issue for security problems.

• Use GitHub's private vulnerability reporting ("Report a vulnerability" under the Security tab) on the affected repository, or
• Email the team at erwin.lejeune15@gmail.com with a description, reproduction steps, and impact assessment.

You will get an acknowledgement within 72 hours. Please give us a reasonable window to ship a fix before any public disclosure.

• Smart contracts (hunter-contracts): not deployed to mainnet before an external audit. Findings against the contracts are very welcome — include the commit hash and, if possible, a failing Foundry test.
• Inference gateway & platform API: prompts are not stored by design; the usage ledger records token counts, never content. Reports that break that guarantee are highest priority.
• Never include real API keys (hk_live_…), private keys, or user data in a report.