Trust and policy disclosure
What the platform will never ask for, what the current code protects, and what remains unverified.
Never share a seed phrase, private key, recovery secret, payment credential, or one-time security code with Crypto Church through a page, message, evidence file, or support request.
The source includes security controls, but no public security certification, penetration-test acceptance, live incident channel, provider readiness, or production approval is claimed.
This page records current strict non-production behavior. It is not an approved production policy, certification, legal opinion, or owner acceptance.
The implementation baseline uses hardened sessions, CSRF checks, server-side authorization, prepared database access, rate limits, input validation, output escaping, and redacted audit metadata where those flows are implemented.
No owner-approved public vulnerability or incident-reporting address is configured. Do not send secrets or personal data to an unverified address; the required contact remains an owner input.
Independent security review, operational incident ownership, response targets, provider and infrastructure evidence, public contact approval, and explicit production activation remain pending.