S3TP is experimental and has not received an independent cryptographic or protocol audit. Do not use it for critical or regulated data.

Never commit private identity keys. Report suspected vulnerabilities privately to the repository owner and include the affected version, reproduction, and impact.