SECURITY
Security is part of the product.
Lumenode is built around the principle that a security research platform must protect both its users and the integrity of its evidence.
Current security controls
- HTTPS transport and security response headers
- HttpOnly and SameSite session cookies
- CSRF protection on state changing forms
- Prepared database statements and strict input validation
- Password hashing instead of plaintext password storage
- Private reports protected by account ownership checks
- Provider keys kept on the server and outside browser code
- Rate limiting and audit events for sensitive actions
- Visible provider freshness and unavailable states
Security limitations
No system can promise perfect security or perfect provider availability. Lumenode does not guarantee that a token, contract, wallet, provider, or account is safe. Security evidence can be incomplete, delayed, wrong, or changed after a report is created.
Security contact
Use the Responsible Disclosure page to report a suspected vulnerability. Do not include private keys, passwords, or unnecessary personal information.
Before launch
The operator must complete independent penetration testing, backup verification, dependency review, access review, and an incident response exercise.