> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unipayfi.pro/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Security practices, audit reports, and responsible disclosure policy

# Security

Security is fundamental to everything we build. We treat user funds as uninsured and design systems accordingly.

## Security Model

<CardGroup cols={2}>
  <Card title="Non-Custodial" icon="shield-check">
    We never hold user funds
  </Card>

  <Card title="Stateless Services" icon="server">
    No user data stored server-side
  </Card>

  <Card title="Open Source" icon="code">
    Critical components are open source
  </Card>

  <Card title="Continuous Auditing" icon="magnifying-glass">
    Regular security reviews
  </Card>
</CardGroup>

## Client-Side Security

All sensitive operations happen in your browser:

```typescript theme={null}
// Private keys never leave the browser
const signedTransaction = await wallet.signTransaction(transaction);

// Only signed transactions sent to services
await fetch('/api/broadcast', {
  body: JSON.stringify({ signedTransaction })
});
```

**Security Properties:**

* Private keys remain in wallet extension
* Transactions signed locally
* Services only see signed transactions
* No ability to access user funds

## Routing Layer Security

<Steps>
  <Step title="Ephemeral Addresses">
    Fresh, single-use deposit addresses with cryptographically secure randomness
  </Step>

  <Step title="Time-Limited">
    Addresses expire after 24 hours with automatic refunds
  </Step>

  <Step title="Atomic Processing">
    Operations complete atomically or fail completely
  </Step>

  <Step title="Monitoring">
    Real-time monitoring with automated alerting
  </Step>
</Steps>

## Audit Reports

### Trail of Bits (March 2026)

**Scope:** Smart contract architecture and client-side security\
**Findings:** 2 medium, 5 low severity (all resolved)

### Kudelski Security (January 2026)

**Scope:** Cryptographic implementation and privacy model\
**Findings:** 1 medium, 3 low severity (all resolved)

## Bug Bounty Program

| Severity     | Reward Range      |
| ------------ | ----------------- |
| **Critical** | $10,000 - $50,000 |
| **High**     | $5,000 - $15,000  |
| **Medium**   | $1,000 - $5,000   |
| **Low**      | $100 - $1,000     |

### How to Report

1. **Contact**: Via GitHub security advisories
2. **Response**: Within 48 hours
3. **Timeline**: 90 days for resolution

## Best Practices

<CardGroup cols={2}>
  <Card title="Wallet Security" icon="wallet">
    Use hardware wallets when possible
  </Card>

  <Card title="Verify Addresses" icon="magnifying-glass">
    Always double-check recipients
  </Card>

  <Card title="Monitor Transactions" icon="eye">
    Track status on Solscan
  </Card>

  <Card title="Keep Updated" icon="arrow-up">
    Use latest wallet versions
  </Card>
</CardGroup>