How your keys are handled
- Keys and recovery phrases are generated in your browser, never on a server.
- Your vault is encrypted with a password only you know before it is written to browser storage.
- Unlocked key material lives in an isolated worker in memory. Closing the tab ends that session and you unlock again next time.
- Signing happens on your device. Only the signed transaction goes out to the public network.
- We never receive your phrase, keys or password, which also means we cannot reset them for you.
What we ask of you
- Write your recovery phrase down offline and keep it somewhere private.
- Use a strong, unique wallet password.
- Lock the wallet when you step away from a shared computer.
- Confirm you are on the real Ledgerly address before you unlock.
- Never type or paste your phrase into anything except a wallet you trust.
Audit our code
The parts of Ledgerly that hold your keys are public, so you never have to take our word for any of this. Key generation, encryption, the vault format, transaction building and signing are all published and readable.
- Key generation and encryption: how your recovery phrase is created, how your password protects it, and the parameters used.
- The vault format: exactly what is written to browser storage and in what encrypted shape.
- Derivation and signing: the standard path your addresses come from, and the fact that the signer never hands a key back out.
- Transaction building: how amounts, addresses, fees and destination tags are checked before anything is signed.
- Worker isolation and the extension shell, so the extension you installed can be rebuilt from the same source.
- Our key-safety tests and every security audit write-up we have done.
Our servers, analytics and deployment configuration stay private. They never receive a key, a recovery phrase or a password, so nothing about your safety depends on reading them. Keeping the interface closed also makes a pixel-perfect copy of Ledgerly harder for phishing sites to ship.
Each publish is tagged to match a released extension version and ships a checksum list, so you can compare what you installed against what we published. Want a specific file or release checked? Email beabulnow@gmail.com and we will point you straight at it.
Reporting a vulnerability
If you find a security issue, email beabulnow@gmail.com with the subject line "Security report". Please include what you found, the steps to reproduce it, and the impact you think it has. A screenshot or short recording helps.
We aim to acknowledge reports within five business days and will keep you posted while we work on a fix. Never include your recovery phrase, private keys or password in a report.
Please do not
- run denial of service tests or spam the app or the public servers it uses
- access, modify or destroy data belonging to anyone else
- use social engineering against users or anyone connected to the project
- publish details of an unfixed issue before we have had a chance to respond
We do not currently run a paid bounty program, and we appreciate every good faith report all the same.