Token Story never requests or stores a seed phrase or private key. Wallet connection is client-side and optional. The current release generates and measures payloads but does not broadcast transactions. Treat generated payloads as untrusted until reviewed. Report vulnerabilities privately through GitHub Security Advisories.