This repository is GreyBound’s open labs and tools (PSBT signer, Taproot DLC builders, review checklists). They are reference code. They are not a hosted wallet and not a production audit of anyone else’s product.

SECURITY_REVIEW.md is a dated review of some of this tree. It is not a warranty and not an invitation to put mainnet funds in the lab.

If you think something here can lose coins, leak keys, or cause a signer to commit to the wrong transaction, email contact@greybound.tech.

Do not open a public issue with exploit details, seeds, or mainnet txids.

Include: which directory and commit, what you expected, what happened, and a repro on signet/regtest with keys you control. A short note is enough; we will ask if we need more.

We read these. We usually acknowledge the same day we see the mail. That is how we work, not a contractual SLA. We will say whether we think it is in this repo, ask questions, and patch or document when it is real.

• greybound.tech, paid reviews, or other people’s wallets (those are not this repo)
• Scanner output with no path to funds or keys
• “Please audit this” with no finding

There is no bug bounty and no payment for reports. Credit in a changelog or advisory if you want it and the fix is in.

Do not send meaningful funds to addresses these tools generate unless you have independently reviewed the spend path. Lending paths in the DLC lab are not the same trust model as the swap claim path; read that project’s PROTOCOL.md.