> ## Documentation Index
> Fetch the complete documentation index at: https://olanas.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Audits and disclosures

> Security review status and responsible disclosure expectations.

## Audit status

| Component                   | Reviewer                      | Date               | Report                                                                                                                   | Status                         |
| --------------------------- | ----------------------------- | ------------------ | ------------------------------------------------------------------------------------------------------------------------ | ------------------------------ |
| OLANAS token contract       | Source verified on Blockscout | September 18, 2026 | [Verified source](https://robinhoodchain.blockscout.com/address/0x9400eB66B1320050A68F25A624985a674F033902?tab=contract) | No independent audit published |
| Vesting contracts           | Not published                 | —                  | —                                                                                                                        | Not audited in this repository |
| Content-paywall application | Not published                 | —                  | —                                                                                                                        | Independent audit not listed   |

<Warning>
  The absence of a published audit means users should not assume the contracts or application have received an independent security review. An audit also does not eliminate risk.
</Warning>

## Current safeguards

The application includes exact-amount validation, chain and recipient checks, confirmed-transaction requirements, payment replay controls, creator signatures, encrypted storage, and production disabling of demo proofs.

## Known operational limits

* Live wallet and settlement behavior still requires end-to-end validation before use with material funds.
* Local file persistence is designed for a single server process, not horizontally scaled workers.
* Wallet transaction replacement requires manual attention.
* Losing the vault secret can make encrypted content unrecoverable.
* Previously exposed plaintext or preview copies cannot be recalled.

## Responsible disclosure

A dedicated security contact and disclosure policy have not been added yet. Before production launch, publish a monitored email address, expected response window, safe-harbor language, eligible systems, and rules for handling sensitive reports.