Only the latest tagged release is considered supported. Security fixes are not back-ported to older versions.

If you discover a security issue in VanityKit, please open a private report via GitHub Security Advisories or open an issue with the label security. Do not post private keys, seed phrases, or other sensitive material in public issues.

VanityKit generates private keys using the operating-system CSPRNG exposed by Python’s secrets module. Keys are validated against the secp256k1 curve order before use.

Recommended practices when generating keys that will hold real funds:

1. Run the tool only on a computer you fully control.
2. Prefer an air-gapped or offline environment.
3. After a match is found, independently verify that the printed private key derives the printed address using a second, trusted tool.
4. Never paste private keys into websites, browser extensions, chat applications, or untrusted software.
5. Clear terminal history and temporary files after the session.
6. Treat any machine that has seen the private key as potentially compromised for high-value use.

VanityKit makes no network requests. There is no telemetry, update check, or remote logging.

The project depends on:

• coincurve (libsecp256k1 bindings)
• pycryptodome (Keccak-256)
• base58
• click
• tqdm

Review the source of these packages if you have strict supply-chain requirements. Consider pinning exact versions and verifying hashes.

• Pure-Python orchestration is slower than dedicated C++/CUDA vanity tools. This is intentional: the priority is readability and auditability over maximum throughput.
• Taproot support is limited to the basic key-path construction. Full BIP-341 script-path and complex tweaking logic is not implemented.
• The difficulty estimator is an approximation that assumes uniform distribution over the address alphabet.

This software is provided “as is”, without warranty of any kind. The authors accept no liability for loss of funds, whether caused by software defects, incorrect usage, compromised machines, or any other reason. Review the source code before use.