Report vulnerabilities privately via GitHub Security Advisory.

Do not open a public issue.

• Source code in packages/ and apps/
• Published @usdh-kit/* packages on npm

Out of scope: Hyperliquid protocol, third-party wallet libraries, signing keys compromised by means unrelated to this SDK.