What stays in the browser
Recovery phrases, imported private keys and JSON secret keys are processed by client-side JavaScript. Transaction signatures are created locally. The application does not intentionally send this secret material to rpc.php or configured Solana RPC providers.
What RPC providers can see
RPC providers receive public blockchain queries such as wallet addresses, token-account queries, transaction signatures and signed transactions submitted for broadcast. Depending on the route used, an RPC provider may also receive the IP address of the relay server or the user's IP address when the browser uses direct fallback access.
Persistent session storage
To restore an open wallet after a browser restart, the application stores an encrypted seed record in IndexedDB. Encryption uses AES-GCM with a non-exportable WebCrypto key generated for the browser profile. Selecting Exit removes the saved wallet record.
Encryption at rest does not protect against malicious code that is already executing with the same website origin while the wallet is open. A compromised server response, browser extension, browser profile or device can still be dangerous.
Application delivery protections
The project does not depend on third-party JavaScript CDNs. Its JavaScript is served from the same site. Content Security Policy restricts script and style sources to the site itself, blocks framing, and prevents plugin objects. HTTPS is required in production.
RPC resilience is not key security
Multiple Mainnet RPC endpoints improve availability, but an RPC should still be treated as an untrusted source of public network data. A malicious or stale RPC can refuse requests or return misleading state. It cannot alter an already signed transaction without invalidating its signature.
User security checklist
- Verify the exact domain before entering private data.
- Keep the recovery phrase or private key offline and never send it to support staff.
- Do not use a device you suspect is infected with malware.
- Review the recipient address and amount before signing a transfer.
- Test a newly imported wallet or new environment with a small amount first.
- Keep an independent backup. Browser storage can be cleared or lost.
Audit status
This project is independently implemented browser-wallet software. Unless the site explicitly publishes a named third-party audit, users should not assume that the code has completed an independent professional security audit. High-value use warrants additional review and risk controls.