Security is a design constraint
Every request passes through an application firewall, strict input validation and a same-origin policy. All admin actions require a verified request token, an authenticated session bound to your browser fingerprint, and are written to an immutable audit log.
What we never do
- We never ask for your seed phrase or private key.
- We never send the routing credential to the browser.
- We never let the browser edit the calldata of an approved quote.
- We never hold user funds. Swaps execute wallet-to-wallet.
Controls in place
- Passwords: modern memory-hard hashing with per-account lockout.
- Secrets: authenticated encryption with authenticated associated data; the encryption key lives outside the database.
- Transport: strict browser security policy, HSTS on HTTPS, preconnect-free self-hosted assets.
- Sessions: HttpOnly cookies, SameSite=Lax, session regeneration on login and idle timeout.
- Quote integrity: quotes are bound to your session, expire in two minutes and cannot be modified client-side.
- Files: uploads are re-encoded, extension-checked and stored outside any executable path.
Responsible disclosure
Found a vulnerability? Email [email protected] with reproducible steps. We acknowledge reports within 48 hours.