Do not disclose suspected vulnerabilities in a public issue.

Use the XPayr contact form and include the repository name, affected version or commit, reproduction steps, and impact. Do not include private keys, seed phrases, live API keys, customer data, or unredacted production logs.

• Use test credentials first.
• Keep merchant secret keys on the server.
• Commit only placeholder values through .env.example.
• Never submit wallet private keys or seed phrases.

This repository contains client code or reference integrations. It does not authorize production access, hold merchant funds, or replace on-chain receipt verification.