Please report a vulnerability privately, by email to info@cleave.fi. Do not open a public issue for it.

Include what you can of the following:

• the affected contract and chain, endpoint, package or repository;
• a transaction hash or the exact request, if there is one;
• the steps to reproduce it, and what you expected to happen.

Cleave's contracts are not upgradeable and can be paused in an emergency. Cleave's own packages (cleave-swap, ai-sdk and langchain-cleave) never take a private key: they return unsigned calls for the user's own wallet to sign.