Security
2026-10-30
Controls
- Strict Content-Security-Policy with per-request nonces; no third-party scripts, fonts or frames.
- HSTS, X-Frame-Options DENY, nosniff, COOP/CORP, restrictive Permissions-Policy.
- Read-only GET API with per-IP rate limits; every input validated by strict patterns.
- Outbound requests only to a fixed allowlist of hosts, with timeouts, size caps and no redirects (no user-supplied URLs).
- Transaction data is cross-checked on two independent Monero nodes before it is shown.
Threat model (short)
- Lying node: needs two nodes to agree; amounts are checked against on-chain commitments.
- Key theft: keys are never sent to the server; we never ask for seeds or spend keys.
- Swap fraud: we only link to RugWard's executable route and label custody honestly; deposit addresses are only ever shown on rugward.com.
- Abuse/DoS: Cloudflare rate limits plus per-isolate limits on endpoints that call external services.
Report a vulnerability
- Contact RugWard via https://rugward.com/support or X @RugWardHQ. Please do not test against other users or run load tests.