Security

HyperToken provides CRDT state, transports, and game extension points. It does not make clients trustworthy, authenticate users, hide data merely because a UI hides it, or provide a security audit. Read the threat model before deploying a game, especially one with money or hidden information.

The default npm run relay service is an unauthenticated relay. The generic network E2E implementation exists but is not wired into the general peer/sync path; its codec encrypted flag is reserved. Cuttle uses it as an example-layer feature with an honest-dealer limitation.