This project has had no independent security audit. Review it yourself before putting real funds or data behind it. Read spec/security.md to see what it does and does not protect against.

Please report vulnerabilities privately through GitHub security advisories, not in a public issue. Include what you found, how to reproduce it, and what an attacker could do with it.

This is a small open source project, so response times are best effort and there is no bounty.

Only the latest v2 code. CIML v1, in legacy/, is unsupported and has known security problems. Do not use it with real funds.