Do not publish vulnerabilities in public issues. Report them privately to the repository maintainer with reproduction steps and the affected version.

DealFlow never stores card numbers, bank credentials, seed phrases, or private keys. Automatic EVM tracking is read-only and cannot sign transactions, withdraw funds, or issue refunds.

Payment confirmation requires a successful receipt, the configured chain, receiving wallet, asset or token contract, accepted atomic amount, duplicate-transaction check, and the configured number of confirmations. Overpayments are held for manager review instead of being silently matched.

Deployment secrets must be stored in environment variables or a managed secret store. Never commit .env, database credentials, Discord tokens, private RPC URLs, or webhook secrets.

All component handlers must verify the current user, guild, order relationship, and required role at execution time.

Shop owners remain responsible for verifying the chain ID, token contract, token decimals, receiving wallet, confirmation policy, and the trustworthiness of their RPC provider.

Digital license values are encrypted with AES-256-GCM. DATA_ENCRYPTION_KEY must be a unique high-entropy secret, must not equal the Discord token or passport signing key, and must be backed up securely. Losing the key makes stored license values unrecoverable.

Deal Passport HMAC signatures use PASSPORT_SIGNING_KEY. Changing this secret invalidates signature verification for passports signed with the previous key unless a key-rotation migration is implemented.

TrustGraph and FlowPulse are advisory explainable scores. They must never be used as the sole basis for denying service, issuing sanctions, resolving disputes, or making legal or financial decisions.