SwapGuard is maintained as an educational, local-fork portfolio project. It has not been audited and should not manage meaningful real funds without independent review, broader testing, deployment controls, and operational monitoring.

The configured router and standard ERC-20 implementations are assumed to behave according to their interfaces. Quotes are estimates, not oracles. Public transactions remain exposed to MEV, front-running, and sandwich attacks. Fee-on-transfer, rebasing, native-token, callback-capable, and other nonstandard assets are unsupported. forceApprove handles common zero-first approval behavior but cannot normalize every token implementation.

The contract limits router allowances, sends output directly to the recipient, rejects stale deadlines and malformed paths, checks router response shape/minimum output, and uses non-reentrancy. These controls reduce risk; they do not make the system fully secure or production-ready.

Open a private GitHub security advisory with a concise impact description, affected code, reproduction steps, and a suggested mitigation. Do not include private keys, RPC credentials, or exploit unrelated systems. Please allow reasonable time for assessment before public disclosure.