Skip to content

Security

Constraints, not adjectives.

What HoodStack actually guarantees, what it does not, and how to tell us when we are wrong.

Guarantees

Properties we hold ourselves to.

A defect in any of these is a vulnerability, not a feature request.

01
No key custody
HoodStack does not store private keys, mnemonics, or signing secrets, and cannot move user funds. There is no mechanism, no administrative path, and no recovery flow that produces one. Architectural, not policy.
02
Tenant isolation
A project cannot read or affect another project's data. Queries are scoped at the data-access layer rather than by callers remembering a filter, and public identifiers are opaque and non-enumerable.
03
Browser/server boundary
No server secret is reachable from a client bundle. The boundary is enforced by package structure and lint rules, not by convention.
04
Chain validation
Chain ID is validated immediately before signing and again before submission, because a wallet can switch networks in between. Mainnet writes require an explicit per-project opt-in.
05
Retry safety
Non-idempotent operations are never retried automatically. A transaction broadcast that times out may already have been accepted, so re-sending it risks submitting twice.
06
Fail closed
A missing feature flag, an absent configuration value, or an unrecognized state disables functionality rather than enabling it.
07
Safe errors
Errors never carry stack traces, SQL, provider credentials, internal hostnames, or another tenant's data across a trust boundary. Details are redacted at construction.

Honesty

What we do not claim.

None of these would be true today, so none of them appear on this site.

  • bank-grade
  • military-grade
  • unhackable
  • audited
  • battle-tested
  • institutional-grade

Reporting scope

What counts as a vulnerability.

  • Authentication or session bypass
  • Cross-tenant data access
  • Privilege escalation within an organization
  • API key or credential exposure
  • Webhook signature forgery or replay
  • Gas sponsorship abuse that bypasses policy
  • Chain-mismatch or transaction-substitution flaws
  • Secrets reaching a browser bundle or a log
  • Rate limits on the shared public RPC endpoints
  • Missing hardening on endpoints documented as unimplemented
  • Social engineering, physical attacks, volumetric DoS

Reporting a vulnerability

Report privately. Do not open a public issue for a security problem.

Good-faith research under our disclosure policy is protected by safe harbour. There is no funded bounty at this time, and we will not imply otherwise to attract reports. The findings we most want are ones where something we claim - tenant isolation, chain validation, redaction, non-custody - does not actually hold.

security@hoodstack.ioPrivate report on GitHub
Security - HoodStack