Get the extension Security by construction
The extension holds no wallet key and the vault never touches the internet, so nothing in the browser can withdraw or send your funds. Every release ships only when the numbers below are green.
No wallet key in the browser
The extension contains no seed and no wallet key. Every transfer is signed by the air-gapped vault and travels back as a QR code, a one-way optical channel that malware on your computer cannot cross. The one key it keeps is a Hyperliquid trading key, approved by the vault, which can place orders but never withdraw or transfer funds.
The numbers behind it
180/180
store package files rebuilt bit for bit
2,000+
automated tests gating every release
0
static-analysis findings tolerated in CI
710
dApp-surface rows, each requiring a green test
Found a vulnerability?
Email us with SECURITY in the subject and steps to reproduce, and never include a real seed phrase or private key.
We acknowledge reports within 72 hours and keep you informed until resolution.
Coordinated disclosure: we ask for reasonable time to ship a fix, 90 days at most.
Safe harbor: good-faith research never leads to legal action. Test with your own funds, on testnets.
Confirmed reporters are credited publicly, unless you prefer anonymity.