Security approach

What is in place, stated plainly. No audit has been done and none is claimed.

In place

• Signing happens locally; a wallet secret never leaves the process and is never printed. Debug output of a wallet shows only its address.
• Wallet files live outside the repository, are created new only, written atomically and, on Windows, readable only by the current user.
• The HTTP client is HTTPS-only, follows no redirects, and talks only to the public testnet server and faucet.
• Every server is asked for its network id first; anything other than testnet is refused.
• Untrusted server responses are checked field by field; a malformed number is an error, never rounded.
• Every dependency is pinned exactly and recorded with its reason in a decision record or a founder flag.
• Testnet and mainnet are separated by rule: a testnet wallet is never to be used on mainnet.

Principles

• Least privilege for every component and credential
• Keys stay in the operator's environment, never in strategy code
• Every action recorded
• Signed builds and a software bill of materials before any release (planned)

Note

These are engineering measures, not certifications. No external audit has been done.