RefMint generates public lookup references. It does not generate or verify authentication tokens, passwords, signatures or authorization grants. A checksum can be recomputed by anyone. Prefixes disclose the configured record type; codes contain no timestamp or machine identity.

Keep a unique database constraint, retry conflicts with a limit, authorize lookups, and rate-limit public endpoints. Collision calculations assume independent uniform generation across the namespace's whole lifetime. A checksum does not improve collision entropy. Never fall back to Math.random when Web Crypto is unavailable.

Do not attempt to repair an invalid code automatically: a guessed correction can select the wrong record. The parser only normalizes the presentation differences documented in SPEC.md.

For a potential vulnerability, use GitHub's private vulnerability reporting if available, or contact the repository owner through their GitHub profile without disclosing exploit details in a public issue. Ordinary reproducible bugs belong in issues. The current package has not had an independent security audit. See the maintenance and support policy. See the 1.x API contract and stability criteria; a stable version is not a security assurance.