How your keys are handled
- Keys and recovery phrases are generated in your browser, never on a server.
- Your vault is encrypted with a password only you know before it is written to browser storage.
- Unlocked key material lives in an isolated worker in memory. Closing the tab ends that session and you unlock again next time.
- Signing happens on your device. Only the signed transaction goes out to the public network.
- We never receive your phrase, keys or password, which also means we cannot reset them for you.
What we ask of you
- Write your recovery phrase down offline and keep it somewhere private.
- Use a strong, unique wallet password.
- Lock the wallet when you step away from a shared computer.
- Confirm you are on the real Ledgerly address before you unlock.
- Never type or paste your phrase into anything except a wallet you trust.
Reporting a vulnerability
If you find a security issue, email jibreelm.dev@gmail.com with the subject line "Security report". Please include what you found, the steps to reproduce it, and the impact you think it has. A screenshot or short recording helps.
We aim to acknowledge reports within five business days and will keep you posted while we work on a fix. Never include your recovery phrase, private keys or password in a report.
Please do not
- run denial of service tests or spam the app or the public servers it uses
- access, modify or destroy data belonging to anyone else
- use social engineering against users or anyone connected to the project
- publish details of an unfixed issue before we have had a chance to respond
We do not currently run a paid bounty program, and we appreciate every good faith report all the same.