# Security

## What this project is (and isn't)
- **Non-custodial.** XRPL Will never asks for, holds, stores or logs seeds, secret keys or funds. It only
  prepares unsigned escrow transactions. **You sign every transaction yourself, in your own wallet**, and a
  validated transaction is **irreversible**. Check every address, amount and date in your wallet before approving.
- **Testnet only.** Non-Testnet hosts and Mainnet are refused in code (`ALLOW_MAINNET = False`). Mainnet stays
  locked until a lawyer gives the go-ahead.
- The Python RPC client (wheel/rpc.py) only reads: the allowed methods are `ledger` and `server_info`; sign and
  submit are blocked and tested. That "read-only" applies to the RPC client, not to the escrows the tool prepares.
- The spin only sets turn order; it is not a security control. Nobody signs for anyone else.

## Protections in place
- Content-Security-Policy (no inline script, no third-party scripts or CDNs, network calls only to the Testnet RPC);
  all user input is rendered with `textContent` (no HTML injection); hosting headers in `frontend/_headers`
  (frame-ancestors 'none', X-Frame-Options DENY, nosniff, no-referrer) plus a frame guard in app.js.
- Address checksums (base58check) are verified in both the page and the Python helpers, so typos and swapped
  characters are refused.
- Integrity self-checks: `verify_tx_matches_review` / `check_plan_integrity` (Python) and `checkTxMatchesReview`
  (page) refuse an unsigned transaction that differs from what the review screen showed.
- Signer guard: every step must be signed by the escrow owner alone, from their own wallet.
- Tampered browser storage (mode, sheet log) is ignored or cleaned instead of trusted.

## Honest limits
These checks run on your device. They catch bugs, page tampering and mistakes, but they **cannot stop a
determined attacker who controls your device or browser**. The real protection is that you read and approve every
transaction in your own wallet, and that this site holds no funds and no keys. Only use the site at its official
address, https://xrpl-will.pages.dev; lookalike sites and anyone asking for your seed are scams.

## Acceptable use
Altering transactions, probing for weaknesses, or otherwise misusing the site is prohibited by TERMS.md and may be
unlawful (see docs/SECURITY_LEGAL_NOTES.md). Good-faith security research reported privately is welcome.

## Reporting a vulnerability (responsible disclosure)
- Email **xrplwill.contact@gmail.com** with "Security" in the subject. Include steps to reproduce; please don't
  include anyone's seed or personal information.
- Please give us a reasonable time to fix it (we reply within 30 days) before telling anyone else.
- Test only on Testnet, only with your own accounts, and don't disrupt the site or other users.
- We will not take action against good-faith reports that follow these rules. No bug bounty is offered.