packages/foundry/contracts/ (MabrurPBM, ClaimRegistry, TIDR) as deployed on Arbitrum One, and the web app. tIDR is a test token with no monetary value. The contracts are unaudited hackathon code; three internal review rounds are summarised in the README.

Please do not open a public issue. Report privately:

• Email edy.cu@live.com, or
• GitHub private vulnerability reporting (Security → Report a vulnerability).

You'll get an acknowledgment within 48 hours.