CryptoValidity is a security-first wallet designed for AI-assisted and autonomous transaction execution. Security, privacy, and execution integrity are core design goals, not optional features.
This document describes how security issues should be reported and how CryptoValidity approaches vulnerability handling.
If you believe you have discovered a security vulnerability in CryptoValidity, please report it responsibly.
Do NOT open a public GitHub issue for security-sensitive findings.
- Email: security@cryptovalidity.com
(or use a private channel provided by the maintainers)
Please include:
- a clear description of the issue
- steps to reproduce (if applicable)
- potential impact
- any proof-of-concept details (redacted where appropriate)
We follow a coordinated disclosure process:
- Report received and acknowledged
- Issue validated and scoped
- Fix developed and reviewed
- Disclosure coordinated when appropriate
We aim to acknowledge reports within 72 hours.
CryptoValidity is built around the following principles:
Transactions must not execute unless explicitly verified and authorized.
Transaction intent, authorization, and execution are treated as distinct steps to reduce blast radius.
AI agents, automation, and external systems are assumed to be fallible or compromised.
Balance visibility, transaction metadata, and execution context are protected by default.
CryptoValidity is designed to integrate with execution-time authorization systems (e.g., A2SPA) rather than relying on a single control layer.
The following are considered out of scope for this repository:
- vulnerabilities in underlying blockchains
- third-party wallet integrations
- user key mismanagement outside CryptoValidity
- social engineering attacks unrelated to execution flow
This repository currently documents architecture and security design. It is not yet a production wallet implementation.
Security posture will evolve as implementation work progresses.
Security is not a feature of CryptoValidity. It is the reason CryptoValidity exists.