docs: mention no audit and llm usage

Author: jcbrand

README.md

@@ -4,6 +4,10 @@
 [![npm version](https://img.shields.io/npm/v/libomemo.js.svg)](https://www.npmjs.com/package/libomemo.js)
 [![License: GPL-3.0](https://img.shields.io/badge/License-GPL--3.0-blue.svg)](http://www.gnu.org/licenses/gpl-3.0.html)
 
+> **Note:** this library has not yet undergone a formal third-party security
+> audit. Review the code before relying on it, and please report any suspected
+> vulnerability privately as described in [`SECURITY.md`](./SECURITY.md).
+
 **libomemo.js** is a TypeScript implementation of the [OMEMO Multi-End Message and Object Encryption](https://xmpp.org/extensions/xep-0384.html) protocol for [XMPP](https://xmpp.org).
 It provides ratcheting forward secrecy for synchronous and asynchronous messaging environments, enabling secure multi-device encrypted communication.
 
@@ -320,10 +324,37 @@ Thank you to the [NLNet Foundation](https://nlnet.nl/) for sponsoring work on th
   wrappers in `native/ed25519/additions/omemo_convert.c` follow its approach so the on-wire
   identity-key encoding interoperates with libomemo-c-based clients such as Dino.
 
+## LLM and GenAI usage
+
+Large Language Models (DeepSeek 4 Pro, Qwen 3.7 max and Claude Opus 4.8) were used
+to assist with tasks such as writing code, editing text and research.
+
+**Where AI was not used:** no cryptographic primitive or protocol logic was
+designed or invented by an LLM. The cryptographic core derives from established,
+widely-reviewed sources:
+
+- [libsignal](https://github.com/signalapp/libsignal-protocol-javascript) for the Double Ratchet and X3DH
+- [libomemo-c](https://github.com/dino/libomemo-c) for the OMEMO 2 Curve25519 & Ed25519 operations
+
+AI assistance was limited to porting, tests, tooling and documentation.
+
+Correctness is checked independently of any AI:
+
+- the test suite runs on Node.js and in a real browser (via Playwright) against
+  known-answer test vectors;
+- the omemo:2 wire format is pinned by a cross-implementation interop vector
+  generated by libomemo-c (the C library [Dino](https://dino.im) uses): the
+  suite decrypts libomemo-c's real ciphertexts and verifies its signatures, and
+  the reverse direction (libomemo-c decrypting this library's output) is
+  confirmed out of band.
+
+Any LLM-generated content is carefully and manually reviewed, as would any 3rd
+party contribution. A human maintainer remains responsible for every line
+regardless of how it was drafted.
+
 ## License
 
 Copyright 2015-2018 Open Whisper Systems
-
 Copyright 2022-2026 JC Brand
 
 Licensed under the GPLv3: [http://www.gnu.org/licenses/gpl-3.0.html](http://www.gnu.org/licenses/gpl-3.0.html)