Security Practices
We follow best practices for securing data
Security Practices
Last Updated: August 5, 2025
Effective Date: August 5, 2025
At Badger+, we take security seriously and implement industry-leading practices to protect our users and their data. Below is an overview of our core security measures:
1. Data Encryption
In Transit: All data is encrypted using TLS 1.3+ to ensure privacy and integrity between your device and our servers.
At Rest: Sensitive data is encrypted at rest using strong, industry-standard algorithms.
2. Wallet & Key Security
Non-custodial by Design: We never store your private keys or seed phrases. All wallet operations are performed client-side.
Secure Wallet Integrations: We support only reputable wallet providers and regularly review integration code for vulnerabilities.
No Blind Signing: We discourage and warn against blind signing of transactions, and display clear transaction details before user approval.
3. Regular Security Audits
We conduct regular internal and external security audits to identify and remediate vulnerabilities.
All critical code and infrastructure changes are reviewed for security impact.
4. OWASP Top 10 Compliance
Our development process is guided by the OWASP Top 10 security risks, ensuring protection against the most common web vulnerabilities.
5. Automated Dependency Scanning
We use automated tools to continuously scan for vulnerabilities in third-party libraries and dependencies.
Vulnerabilities are patched promptly as part of our CI/CD pipeline.
6. Rate Limiting
All API endpoints are protected by rate limiting to prevent abuse and mitigate denial-of-service attacks.
7. CSRF Protection
State-changing operations are protected by CSRF (Cross-Site Request Forgery) tokens to prevent unauthorized actions.
8. XSS Prevention
User-generated content is sanitized using DOMPurify and other best-in-class libraries to prevent Cross-Site Scripting (XSS) attacks.
9. JWT Authentication & Secure Key Management
We use signed JWTs (JSON Web Tokens) for authentication, with secure, regularly rotated signing keys.
Keys are managed using best practices and never exposed in client-side code.
10. Bug Bounty & Responsible Disclosure
We encourage responsible disclosure of security vulnerabilities. Please see our security.txt for contact details.
Contact & Reporting
If you discover a vulnerability or have a security concern, please contact us at [email protected]. For sensitive reports, use our public PGP key to encrypt your message. For more details, see our security.txt.
Last updated