Email freclean7@gmail.com with details. Do not open a public issue for unpatched vulnerabilities.

• This dApp never requests, stores, transmits, or logs a private key or seed phrase. All signing happens inside the user's own wallet (Valora or another Celo-compatible wallet).
• src/lib/wallet.tsx only reads an already-connected account address and chain ID from the browser-injected provider — it cannot initiate a transaction without an explicit wallet-side confirmation.
• No analytics or third-party scripts are loaded on checkout or status pages in this build.

• Wallet connection currently supports only an injected provider (a desktop browser extension, or a wallet's in-app browser). A production build should add a proper WalletConnect v2 session so a user can scan a QR code from Valora on a separate device — see the comment block at the top of src/lib/wallet.tsx.
• /api/payments and /api/assets currently require a staff-authenticated token in freclean-api. This dApp calls them without one, so checkout and history will fail against a real deployment until a public, rate-limited checkout endpoint exists — tracked in this repo's README roadmap.
• No CSP headers are configured yet at the hosting layer.