Custody

What we cannot do

• Read your keys. They live in a vault frame on its own origin (vault.glitch.guru), encrypted under an AES-GCM-256 key the browser marks non-extractable. The server never receives a key, a seed, a passphrase, or a signed transaction — the frame broadcasts straight to the blockchain node.
• Sign for you. Nothing on the server can produce a signature; there is nothing on the server to produce it with.
• Reach the frame from the page. The frame is a different origin: the browser's same-origin policy keeps the page's scripts out of its memory and storage. The page talks to it over postMessage, by method name, and gets back addresses, balances and transaction hashes — never a key.
• Take a key out silently. A key is shown, funds are sent outside the vault, a wallet is removed, or a backup is written only after a button is clicked inside the frame's own dialog, with a trusted click, while the dialog is visible on screen. A script cannot produce that click; this page cannot either.
• Send anything anywhere else. The vault origin's Content-Security-Policy names four blockchain nodes as the only network destinations. Not this server. Not analytics. The header is read live below.
• Recover your keys for you. There is no account and no server-side copy. If you lose this browser's storage and have no backup file, the keys are gone — that is the price of nobody else having them.

What we can do — and how you would notice

• Change the code. Any hosted wallet's operator can ship different JavaScript; that is the one thing no architecture removes. So the vault frame pins the engine it runs with Subresource Integrity, the hashes of every file the frame is made of are published in /releases.json, and this page fetches what the server serves and hashes it in front of you. A changed engine is a changed hash.
• Take the site down. Your keys are not on it. Export or back them up and use them in any wallet.

How to keep your keys

• Back up. Wallets → Back up writes one encrypted file for all your keys under a passphrase only you know (PBKDF2-SHA-256, 600 000 rounds, AES-GCM-256). Keep the file and the passphrase in different places. Restore works in any browser, on any device.
• Use a dedicated trading wallet. Fund it with what you trade with. Keep the rest elsewhere.
• Check this page after anything feels off. A row that says fail means a promise above does not hold in your browser at that moment — stop and export.

Report a problem

Found a way around any of this? Tell us before anyone else: security reports go to the address in SECURITY.md of the repository. Do not include keys or funded-wallet credentials in a report.