NO CUSTODY
No seed phrase or private-key custody in SafeSign or Security Core.
DEVELOPER DOCUMENTATION
Integrate the review boundary — not the custody boundary.
UTXO Suite documentation is now centered on transaction security: how requests enter SafeSign, what Security Core may analyze, where user authorization remains, and which integration surfaces are current versus future work.
SECURITY MODEL
Four invariants before implementation details.
These constraints are more important than any framework choice. If an integration breaks one of them, it is outside the intended product model.
PAYLOAD INTEGRITY
Do not mutate the transaction payload presented by the calling wallet or dApp.
EXPLICIT AUTHORIZATION
Do not auto-sign or auto-broadcast. Authorization remains explicit.
FAIL VISIBLE
Unavailable evidence is uncertainty — never a silent allow.
REQUEST LIFECYCLE
Request → decode → context → review.
The integration boundary should preserve the original request while adding human-readable evidence around it.
REQUEST
Receive a supported wallet request plus the context available at the integration boundary.
DECODE
Normalize method, parameters, typed data, approvals or supported PSBT structure.
CONTEXT
Enrich with deterministic policy, destination context and simulation evidence when available.
REVIEW
Present material risk and uncertainty in SafeSign; the user or calling wallet makes the final authorization.
GUARD / MANIFEST V3
Current browser integration foundation.
The repository contains a source scaffold for Chrome/Brave. It wraps ethereum.request in page context, communicates with an isolated content script and waits for an explicit continue/reject decision. A production extension build pipeline is still required.
ethereum.request → SafeSign → original provider
// browser/page context — conceptual integration boundary
const original = ethereum.request.bind(ethereum)
ethereum.request = async (request) => {
const decision = await reviewWithSafeSign(request)
if (decision !== "continue") throw new Error("User rejected")
return original(request) // forward unchanged
}Local preferences only: enabled state, strict mode, allowlisted domains and dismissed education cards. Never persist private keys, seeds, raw signatures or full transaction history.
INTEGRATION STATUS
Do not infer backend capability from a polished UI.
Each surface has a different implementation boundary. Documentation names that boundary instead of collapsing everything into a single 'released' label.
UTXO GUARD
Guard — Manifest V3 source foundation exists; production build/distribution remains separate work.
UTXO WALLET
Wallet — current UI surface exists; real send/approve/sign/connect flows must invoke SafeSign before confirmation.
UTXO RELAY
Relay — route/fee/PSBT analysis surface exists; future signing and route execution should preview PSBTs through SafeSign.