Skip to content
Open the app

Menu

Open the app

Security

Found a vulnerability? Thank you. Please tell us privately first.

How to report

Open a private security advisory on the GitHub repository. Please do not open a public issue for a vulnerability.

A useful report includes:

  • the affected part: an account or vault contract, the guardian, the API or this site;
  • the steps to reproduce it, ideally on testnet;
  • what an attacker could gain, and what you think the fix is.

Ground rules

  • Test against your own accounts only, and never access other people's data.
  • Do not degrade testnet services for others.
  • Give us a fair chance to fix the issue before you disclose it.

Limits built into the design

  • The guardian can only take protective actions. The account contract refuses any transfer out.
  • Every action stays within the owner's mandate, and the owner can revoke or override at any moment.
  • The guardian runs in a TEE, with a signing key bound to its exact build.
  • Each rescue carries the hash of a signed, verifiable AI review on chain.