Security

Qlyphs asks you to trust as little as possible, and lets you check the rest. What protects your keys on your device is described in The wallet; this page is about checking the code.

Open sourceCopy Anchor Link

The wallet is open source under the MIT licence: github.com/yacinealloul/qlyphs-wallet. It covers Qlyphs Keys, the extension and the provider that sites use to talk to the wallet.

Verify keys.qlyphs.comCopy Anchor Link

A web wallet downloads its code on every visit, so you should be able to check what you received. Release builds are deterministic with the same source, locked dependencies, pinned toolchain and build configuration. The Docker procedure below supplies the release build environment.

Each GitHub release (tag keys-v<version>) publishes a release hash, the SHA-256 of the list of every file the site serves. Every response from keys.qlyphs.com carries it in the x-qlyphs-release header.

curl -s https://keys.qlyphs.com/SHA256SUMS.txt | shasum -a 256

node apps/keys/verify.mjs https://keys.qlyphs.com --expect <release hash>

A check proves what the site served to you, when you checked. It cannot prove that everyone else received the same files. An installed extension uses its installed package between updates, but its package source and future updates remain trust boundaries. Store distribution and independent wallet security review are not yet complete.

How the page is locked downCopy Anchor Link

• The page loads scripts and bundled dependencies only from its own origin: no third-party script origins, analytics or eval.
• Its content security policy permits connections to its own origin and the RPC/data-service origins fixed at build time. A connected dapp cannot replace those endpoints.
• It cannot be embedded in another site.

Report a vulnerabilityCopy Anchor Link

Report it privately through GitHub's private vulnerability reporting. Please do not open a public issue for a security problem.