Security

Address-entry mode

• The user enters a public EVM address and the server uses it to select a read-only portfolio.
• This mode is not proof of wallet ownership and must not be described as owner authentication.
• Knowing a public address is sufficient to view its associated portfolio while the administrator keeps this mode enabled.

Wallet-signature mode

• The service issues a short-lived server challenge.
• The wallet signs a Sign-In with Ethereum (EIP-4361) message for the current domain.
• Supabase Auth verifies the message structure, domain, time, and cryptographic signature.
• After verification, the server binds the session only to the verified Web3 Ethereum identity.
• If sign-in asks for a seed phrase/private key, transfer, token approval, or movement of funds, stop the action.

Route protection

Portfolio and project routes receive the address only from server-side state for the current mode: an HttpOnly lookup cookie or a verified Web3 session. A wallet URL parameter is neither address selection nor authorization.

Reporting a concern

A dedicated public security contact has not yet been published. Do not post secrets, seed phrases, private keys, or active session tokens in public messages. A verified channel will be published in the interface when available.