Security practices

Protocol security

• Programs are intended to be reviewed by independent auditors before mainnet, with reports published in full.
• Privileged keys are intended to be held in multi-signature custody with time-locked upgrades.
• A responsible disclosure channel is open at all times: security.txt.

Website security

This site is served over HTTPS only, sets strict security headers, never asks for a private key or recovery phrase, and does not store wallet secrets. Wallet connection happens inside your wallet extension, and every transaction must be approved there.

Protect yourself

• Bookmark the official site and ignore links sent in direct messages.
• Nobody from VIVI will DM you first, ask for funds, or promise guaranteed returns.
• Use a hardware wallet for anything you cannot afford to lose.
• Review every transaction, and revoke token approvals you no longer need.

Report a vulnerability

Email security@vivi.example with a description and reproduction steps. Please give us a reasonable time to fix the issue before disclosing it publicly, and do not access data that is not yours.