Baraza Protocol is non-custodial. The protocol never holds community funds or keys, and never moves payments.

Report vulnerabilities privately to [security contact email]. Do not open public issues for security reports. We aim to acknowledge within a few business days.

Do not commit secrets. Private keys, mnemonics, and .env files must never be tracked. If you believe a key has been exposed, report it so it can be rotated.