MemoMail is non-custodial by default. It must not collect secret keys, mnemonic phrases, or custody credentials.

Security fixes are applied to the latest main branch until releases are formalized.

Do not open public issues for sensitive security reports. Contact maintainers privately with reproduction steps, impact, and suggested fixes when available.

• No private-key handling.
• No transaction signing in the app.
• No custody of funds.
• Payment requests must show destination wallet, memo, amount, asset, and network.
• SEP-7 links must be generated from validated Stellar public keys.
• Future Soroban work should focus on message/payment-request attestations and reputation proofs, not escrow.