Security
Security in jeetproof is shared: we harden the platform, you protect your seed phrase and devices.
What the platform does
Section titled “What the platform does”- Encryption at rest - wallet private keys are encrypted with AES-256-GCM under a key derived from your own vault seed.
- Non-custodial by design - keys are decrypted only in memory at execution time, never stored in readable form.
- Phishing-resistant auth - passkeys are domain-bound by the WebAuthn spec; wallet sign-in proves ownership via a signed message.
- Sessions - JWTs that expire after 7 days, stored hashed, and revocable.
- Tenant isolation - every query is scoped to your account; users can’t see each other’s data.
- Production hardening - CSRF protection, rate limits, and crash isolation on the backend.
What you must do
Section titled “What you must do”- Guard your seed phrase. Offline, never shared, never pasted anywhere but the login flow. It cannot be recovered.
- Protect your login device for passkeys, and your wallet for wallet sign-in.
- Be careful exporting keys. An exported private key is outside the vault’s protection.
- Verify the domain before entering anything - only use the official jeetproof URL.
Reporting
Section titled “Reporting”Found a security issue? Reach out through the channels in the site footer before disclosing publicly.