This project is security-first.
The wallet is designed as a self-custody system where users control their own wallet keys.
Security issues involving wallet secrets or transaction integrity are treated as high priority.
Never include the following in issues, pull requests or logs:
- Seed phrases
- Private keys
- Authentication secrets
- API secrets
- Recovery phrases
- Wallet passwords
The following areas require additional security review:
- Cryptographic operations
- Wallet creation
- Wallet recovery
- Private-key handling
- Secure storage
- Transaction signing
- Transaction construction
- Network selection
- Browser extension permissions
- Authentication
- Session management
-
Do not implement custom cryptography when an appropriate audited library exists.
-
Never log private keys or seed phrases.
-
Never send self-custody private keys to backend services.
-
Validate blockchain network and transaction information.
-
Fail closed when security-critical information is uncertain.
-
Keep exchange/custody functionality separated from the self-custody wallet.
Security-sensitive changes require explicit review before being considered production-ready.
Security incidents should be documented and handled using the incident-response procedure in:
docs/INCIDENT_RESPONSE.md