Security & builds

Every release is built reproducibly and its SHA-256 checksums are published here and in the repo's releases.json. To verify the live site matches the source:

1. Clone the repo at the release's git tag (shown in the table)
2. npm ci && npm run build
3. Compare sha256sum dist/assets/* against the full checksum in the table (click to copy)
4. Confirm the bundle name served at pearlpurse.vercel.app matches

Note on trust roots: the table below is served from the same origin as the app — a compromised deploy could rewrite both. The git repository is the root of trust; this page is a convenience check. Signature-signed releases (minisign) are on the roadmap.

• Protected: seed at rest (PBKDF2-600k AES-256-GCM vault, password never stored), XSS exfiltration (strict CSP script-src 'self'), clipboard address-swap (in-app sanity check), sub-fee/dust sends (build-time guards), single-UTXO fee mis-estimates (real fee curve + headroom).
• Not protected (yet): a compromised device (keyloggers, malicious browser extensions read the decrypted seed from memory), server-side index lying (Blockbook is trusted for balances — SPV verification is on the roadmap), physical coercion.
• Never: we can't move your funds, reset your password, or recover your seed. That's the point.

• Strict CSP + nosniff + DENY framing + no-referrer (vercel.json headers)
• Same-origin relay only — wallet never calls third-party origins
• Zero runtime dependencies in the API path; Node 22 pinned
• Automated test suite: crypto vectors, system, security, vault, rotation (see repo)