Foot-gun = no fun. I ran a small Cashu mint for 1 year. Yesterday I found it empty. About 1.5M sats gone, and only around 247k had ever been put in. Nobody broke into my server. Nobody touched my node. I did this to myself. The setup file that comes with the software has a line that says, in plain words, "put a random key here." It even tells you the command to make one. I did not run the command. I pasted the instruction itself in as my key and hit go. It started up fine. That was the problem. For months my mint's secret key was a sentence that anyone who has ever opened that setup file has seen. Eventually somebody noticed, used it to print themselves fake money from my mint, and cashed it out. I was stupid twice. Once, because I never read the one line you are supposed to read twice. Twice, because I saw it start and took that as "it's safe." Nutshell software does refuse to start on a couple of obviously fake keys. It just does not refuse its own example. Should it? Yes, and I have sent them a fix. Should I have checked instead of assuming? Also yes. If I never looked at what the guard rail was, I do not get to blame the guard rail. The mint is off for good. Open source is retards helping retards. This week I was the retard. So here is my turn helping: a fix and a warning. I still believe in this stuff. The bug that got me was in a file I could open, read, fix, and send back the same day. That is the whole point.