Atomic first

Funds move through the pinned atomic-swap protocol, not through an omnibus Harpocrates wallet. Active swaps must remain claimable/refundable if the website disappears.

Local signing

EVM transactions are signed by the user's wallet. Monero wallet state remains in the local swap engine. The public server never needs either private key — and never asks who you are.

Launch gates

Uncapped mainnet is blocked until two independent security reviews, legal approval, a bug bounty, incident response and production infrastructure are configured.

Verification

Production releases publish source commit, deployment address, bytecode verification, audit hashes and signed release manifest.