Security

Where the keys live

The seed phrase, private keys, encrypted wallet file, and security settings stay in your browser's local storage. Creating a wallet, unlocking it, and signing a transaction happen on the device. Those secrets are not part of the requests the app sends to read a balance or a price.

The wallet locks itself when you step away, and a password is required to open it again. The password is not stored in a form we can use to recover the wallet. If you lose both the password and the seed phrase, access is gone.

What you still have to protect

Anyone with your seed phrase can move the funds. Anyone with your unlocked device can use the wallet. Keep the phrase offline, and do not type it into a website, a form, or a message. We will never ask for it. A longer set of practical answers is on the FAQ.

Reporting a weakness

If you find a security problem in this website or in the LGR Wallet app, email security@. Include the page or version, the steps you took, and what the problem lets someone do. Please give us a reasonable time to reply before you publish the details.

In scope

• This website
• The LGR Wallet app served from it

Out of scope

• Blockchain networks, third-party nodes, and price providers
• WalletConnect and other services the app calls
• Ledger hardware, firmware, and Ledger Live
• Phishing, social engineering, and physical access to a person's device

Good-faith research

If you look for a weakness in good faith, we will not pursue a legal claim against you for that research, as long as you do all of the following:

• Tell us within a reasonable time at security@
• Do not access, move, or disclose anyone else's funds or personal data
• Do not interrupt the service for other people
• Give us a reasonable chance to fix the issue before you publish it, unless we agree otherwise

This statement covers research on the in-scope systems. It does not cover other unlawful activity, and it does not bind Ledger or any other company. We do not run a paid bounty program on this site.

Ledger devices

LGR Wallet can pair with a Ledger device so you can sign a transaction on the device. The keys on the Ledger stay on the Ledger. You buy, set up, and keep that device yourself.

Ledger is a trademark of Ledger SAS. LGR Wallet is not affiliated with, sponsored by, or endorsed by Ledger SAS. Pairing is compatibility with a third-party product, not a partnership.

Independent review

No independent security report is published on this site yet.

We welcome a good-faith review of the wallet and this website. When a report is public, the link will be added here. Until then, send findings to security@.