Current boundaries
- No private keys or seed phrases are requested or stored.
- Wallet connection requests an address, without signing or spending approval.
- Server RPC methods are allowlisted. There is no transaction broadcast method.
- Unsigned review checks the configured Solana network, payer, required signer count, and lookup-table ownership.
- Unknown programs and incomplete semantic validation remain visible. A passed simulation does not mean a transaction is safe or approved.
- Saved reports are scoped to the authenticated user on every query. Writes require same-origin JSON requests.
- Provider requests use fixed destinations, validation, timeouts, and response limits. Financial estimates use decimal arithmetic.
Before funds can move
Every instruction and nested account must be decoded against a pinned protocol version. Verify exact integer amounts, reserves, markets, mints, destinations, obligation owners, authority changes and compute fees. Reject additional or unknown actions. Refresh price, account and quote state, and invalidate review after a wallet or input change.
Independent review, failure-recovery testing and explicit user authorization are mandatory release gates. The current app deliberately provides no signing or submission path.
Review status
Internal tests are not an audit. No external audit, lender approval, security certification, banking license or deposit insurance is claimed. The release is a research beta, not an audit-approved lending interface.
Dedicated RPC reliability, upstream outages, identity boundaries, database retention, supply-chain security and incident response still require production operational review.
Reporting concerns
A public security contact is not configured. Do not submit credentials or seed phrases. The project must establish an accountable operator and security reporting channel before public financial launch.