Contract security quick-scan

Static-analysis hits are leads, not confirmed bugs — battle-tested contracts trigger many detectors by design. See the AI audit-checklist reports for triage. Want a contract scanned? Open an issue on GitHub; maintainers run the security-scan workflow with the address.