🚀 Bundlr Security Policy
Last Updated: February 2025
At Bundlr, security is our top priority. We have implemented robust security measures to protect users' private keys, transactions, and personal data. This document outlines the security protocols we follow to ensure a safe and trustless environment for token bundling and trading.
🔐 1. Client-Side Security
- In-memory handling of private keys to prevent long-term storage.
- Immediate clearing of sensitive data after transaction execution.
- Secure input masking to protect private key entry from being exposed.
📝 2. Transaction Signing Flow
- All transactions are signed locally in the user's browser.
- Only signed transactions are sent to the backend, ensuring no raw private key exposure.
- Bundlr never transmits or stores private keys—users maintain full control.
🛡️ 3. Secure Key Handling
We have implemented a SecureKeyHandler class that ensures:
- ✅ Sensitive data is immediately cleared from memory after signing.
- ✅ All private keys are used only in-memory and never persist.
- ✅ Validation of secure execution context to ensure safety.
- ✅ Detection of potential security risks, such as browser vulnerabilities.
🛑 4. Enhanced Input Security
- Clipboard auto-clearing to prevent private keys from being copied and leaked.
- Screen capture prevention during sensitive operations.
🌍 5. Context & Risk Validation
Bundlr actively monitors the security of the environment in which it operates:
- 🔒 Ensures HTTPS usage for secure communication.
- 🛠️ Detects developer tools to prevent potential debugging-based attacks.
- 🧩 Flags conflicting wallet extensions that could interfere with security.
🔗 6. Secure Bundle Creation
Our createBundle function follows strict security protocols:
- ✅ Uses secure key handling to prevent memory leaks.
- ✅ Immediately clears private keys after transaction signing.
- ✅ Ensures robust error handling to avoid data persistence in case of failure.
🌐 7. Network Security
- All connections use HTTPS for encrypted communication.
- Content Security Policy (CSP) headers prevent cross-site attacks.
📢 8. User Warnings & Education
- Clear security warnings near private key input fields.
- Education on Bundlr's policy: We never store private keys—users maintain full custody of their wallets.
🔍 Continuous Security Audits
Security is an ongoing process. We regularly:
- ✔️ Conduct internal security audits to identify vulnerabilities.
- ✔️ Implement updates and patches to strengthen security.
- ✔️ Provide educational resources to help users stay secure.
📩 Contact Us for Security Concerns
If you identify a security issue or have concerns, please contact us:
- 💬 Community Chat: Telegram
🚀 Bundlr is committed to providing a safe and secure trading experience. Stay protected, stay in control! 🔐🔥