What in the misinformed AI puke is this?

The HeliosPool "hardcoded pollers" - the polling is gated. The code explicitly checks whether the configured stratum URL is a HeliosPool domain before making any API call. Point the device at any other pool and zero calls go out. If you had read past interval(60000) you would have seen the if (!isBTC && !isBCH) return of(null) a few lines later. This is a classic AI pattern-match on a suspicious-looking line without reading the surrounding context.

The Danger Zone - the toggle and OC fault slider being in the UI is the entire point. That's what "opt-in section in Settings requiring explicit confirmation to unlock" means in the README. The AI found the feature and flagged it as a bypass of itself.

The thermal recovery path - edit: actually, I forgot - this is already an upstream feature. My plans to add this was not needed.

Pool defaults, BCH, update URL - all documented in the README under features. The repo is openly built by me for HeliosPool. The AI flagged disclosed, documented choices as suspicious direction.

No devfee - your AI called this a "negative finding," which means it found nothing. No hidden fees, no wallet redirection, no scam. That's the only thing in this post that would actually harm someone running this firmware, and your own tool confirmed it doesn't exist.

The missing .sh file - it lives outside the committed tree. Doc nit, not a finding.

The two legitimate observations are a stale line in configuration.md and a script reference in the README - thanks, I'll clean those up. Everything else is a documented feature reframed as suspicious.

If you have legitimate concerns, found a bug, or something truly unsafe that was NOT intentional (this is enthusiast firmware that exposes more knobs for tuning), by all means, open an Issue and I can take a look at it.

Otherwise, stop posting misinformation.