◈ DEFI-VISION · Security
How we keep this safe — and how you tell us when it isn’t.
Posture
Defi-Vision is non-custodial by design. We never hold, control, or have access to user funds, private keys, seed phrases, or wallet recovery data. Every swap, perp, limit order and pool action is signed by the user’s own wallet and broadcast to the Solana network — Defi-Vision is the interface that helps you decide, not the custodian that handles your money.
Account access is wallet-native: there is no email signup, no KYC, no password store. The authenticated surface the platform does expose (operations dashboard, premium gating) is enforced server-side, and the keys that protect it live as server-side environment secrets — never in the client bundle.
In scope for responsible disclosure
- Anything on defi-vision.com and its subdomains.
- The public API at
/api/v1/*. - The broadcast workers (Bluesky / Nostr / Telegram / RSS endpoints).
- The webhook delivery pipeline.
- The premium payment flow (SOL / Pix) and referral commission logic.
- The treasury wallet address resolution path.
Out of scope
- Issues in the Solana network itself, or in third-party programs the user chooses to interact with through their wallet — those are not under our control.
- Reports requiring user social-engineering as the trigger (we can’t fix someone deciding to paste their seed phrase into a phishing site).
- Generic best-practice complaints unconnected to an actual exploit (e.g. “you should add CSP header X” without a proof of harm).
- Reports generated by automated scanners with no manual verification.
How to report
Email a description of the issue, the steps to reproduce, and the URLs or commits affected. Please do not open a public issue, post on X, or paste a proof of concept in a public chat before we’ve had time to acknowledge and patch.
security@defi-vision.comWhat you can expect from us
- Acknowledgement within 72 hours.
- Triage with severity assessment within 7 days.
- Fix and credit on resolution, including a public mention in this page’s Hall of Fame (below) if the reporter wants attribution. No payout policy yet — Defi-Vision is bootstrapped — but credit is real.
Hall of fame
Empty for now. When the first report lands and is fixed, the reporter — with their permission — gets named here.
Critical issues
If you discover something that, in your judgement, can drain user funds or compromise the treasury, please reach out immediately via security@defi-vision.com with the subject line starting [CRITICAL] so it is routed to the priority queue.