Security

How to report a problem, and how to check that the SignLens you run is the one published.

Reporting a vulnerability

A way to make SignLens show a transaction as something it is not, pass a request on without your decision, or send what it says it does not: write to security@signlens.dev, not to the issue tracker, as the extension's security policy says. An explanation that is wrong or unclear goes through the feedback strip under it.

What SignLens never does

• It never asks for a seed phrase or a private key, and holds none.
• It never signs anything: every signature is your own wallet's, after its own prompt.
• It never changes a transaction: what goes to your wallet is the copy of the bytes it explained.

Checking a release

Each release package is built reproducibly, on Linux, macOS and Windows, which must produce the same bytes, and is published with its SHA-256 and a build provenance attestation. The README's verifying a package shows how to check both, and how to rebuild a release from its tag and get the same bytes.

Permissions

The extension stores its settings, and reaches the API, the RPC and the token list in the settings. It runs in the pages you visit to offer itself as a wallet to dapps there.

Try it: install SignLens for Chrome or Firefox.