Security practices

Keys#

• Never commit a private key or keypair file, including Testnet ones: not in code, config files, .env.example, scripts, compose files, docs or tests.
• Load keys from the environment or a secret manager at runtime, and fail loudly when one is missing instead of falling back to a literal.
• Never put any private key in a client bundle (web app, extension, mobile app). Scan your built artifacts before release.
• Treat every Testnet key as exposed. Never reuse one on Mainnet or any other chain, and never send real assets to a Testnet address on another network.

const keypairPath = process.env.KYVRO_KEYPAIR;
if (!keypairPath) throw new Error("KYVRO_KEYPAIR is not set");

Verify before you sign#

• Check the genesis hash (A8qzbNkAdT1GsqmyKTifWnTgS7PuqqmniwdsGeaPc5Jo) before signing anything: it is the only proof you are on Kyvro Testnet and not a lookalike cluster. There is no chain ID to check.
• Inspect every transaction's program IDs and account flags before approving. A malicious program cannot take what the transaction does not mark writable or signer — but it will take everything it is given.
• Before trusting a program, check its upgrade authority on the explorer; before trusting a token, check its mint and freeze authorities on its token page(opens in a new tab).
• Transactions expire with their blockhash, which bounds replay: never sign a transaction with a blockhash you did not just fetch, and never re-sign an old one blindly.

Protecting your users#

• Never ask users for a seed phrase or private key, and say so in your app.
• Label Testnet assets as test assets with no value; never show a price for them or suggest they can be redeemed.
• Anyone can create a token with any name and symbol. Identify tokens by mint address — tKUSD is FPwMXWSGLm8ZBi5YDJroGMZjXqnYQgCmGCzVqs3YcgXe — never by symbol.

Reporting vulnerabilities#

Include affected components, reproduction steps and transaction signatures. Never include private keys or seed phrases; the form rejects them.