Skip to content

4.0Access & security

Security principles

The rules every tool follows, and how to tell us about a problem.

Rules

  • Standard algorithms only: FIPS 203, 204, 205, plus AES-256-GCM, HKDF and PBKDF2 from the browser.
  • No tool requests recovery words, key exports or token allowances.
  • Scans and watches are read-only. Commons sends a transaction only when you press its button.
  • Secret keys and readable content never leave your device.
  • Contracts without owners, fees or upgrades.
  • Estimates are quoted as estimates, with sources.

Server limits

Every request body is size-capped while it streams, every stored record has an expiry, and every public endpoint has a per-network budget. The RPC relay forwards only read methods for a fixed list of contracts.

Reporting a problem

Send details privately to @kibora on X. Please do not post a working exploit in public before it is fixed.