Security and Privacy

Prophetao Wallet prioritizes security, privacy, and transparency. Learn how to verify downloads and understand our security practices.

Security Model

Core Principles

  • Local-only vault: Your keys never leave your device
  • Strong encryption: Argon2id KDF + AES-256-GCM
  • Hard derivation: Prevents public key derivation attacks
  • Memory protection: Immediate zeroization of secrets

Threat Mitigation

  • Spoofing: Explicit origin display in prompts
  • Tampering: Signed releases with checksums
  • Repudiation: Transaction hashes and metadata
  • Privilege escalation: Per-site permissions

Privacy Model

Data Collection

  • Wallets: No telemetry or analytics collected
  • Website: Google Analytics with anonymized IP addresses
  • Private keys: Never transmitted or stored remotely
  • Transaction data: Only what's necessary for blockchain interaction

Data Storage

  • Vault: Encrypted locally using device storage APIs
  • Settings: Stored locally, no cloud sync
  • Address book: Encrypted within the local vault

Why Choose Prophetao

Security & Privacy First

Local-only vault with Argon2id KDF + AES-256-GCM encryption. No telemetry, no tracking, complete privacy with keys that never leave your device.

Built for Bittensor

Native TAO support with sr25519 keys, SS58 addresses, and Substrate integration. Optimized for Bittensor network.

Open Source

Fully transparent code under AGPLv3. Audit the security model, verify builds, and contribute improvements. No hidden backdoors or telemetry.

Verify Downloads

SHA-256 Checksum Verification

Every release includes SHA-256 checksums to verify file integrity. Compare the hash of your downloaded file with the official checksum:

Linux/macOS:
sha256sum prophetao-wallet-v1.0.0-linux-x64.AppImage
Windows PowerShell:
Get-FileHash prophetao-wallet-v1.0.0-windows-x64.exe -Algorithm SHA256
Expected output format:
a1b2c3d4e5f6789012345678901234567890abcdef1234567890abcdef123456 prophetao-wallet-v1.0.0-linux-x64.AppImage

Sigstore Verification

All releases are signed using Sigstore with GitHub OIDC for keyless signing. This provides cryptographic proof that the release was built by our official CI pipeline:

Install cosign (one-time setup):
# See https://docs.sigstore.dev/cosign/installation/
go install github.com/sigstore/cosign/v2/cmd/cosign@latest
Verify signature:
cosign verify-blob \
  --certificate prophetao-wallet-v1.0.0.sig \
  --signature prophetao-wallet-v1.0.0.bundle \
  prophetao-wallet-v1.0.0-linux-x64.AppImage

Important: Only download releases from our official GitHub repository. Third-party distributions may not be signed or verified.

Software Bill of Materials (SBOM)

Each release includes a CycloneDX SBOM detailing all dependencies and their versions. This enables security auditing and vulnerability tracking:

SBOM files included in each release:
  • • prophetao-wallet-sbom.json (CycloneDX format)
  • • prophetao-wallet-sbom.xml (CycloneDX format)

Reproducible Builds

Build Environment

  • CI: GitHub Actions with Ubuntu 22.04
  • Node.js: LTS version (specified in .nvmrc)
  • Package Manager: pnpm with lockfile
  • Dependencies: Pinned versions in package.json
  • Build Tools: Deterministic timestamps

Verification Steps

  1. Clone the repository at the release tag
  2. Use the same Node.js and pnpm versions
  3. Install dependencies with pnpm install --frozen-lockfile
  4. Build with pnpm build
  5. Compare checksums with official release

Report an Issue

Found a bug or security issue? Report it on GitHub for transparent community discussion and resolution.

Report issue on GitHubDiscord
prophetaoProphetao
Copyright © 2025 Prophetao
Licensed under AGPLv3
DownloadContributeSecurity
Privacy PolicyLicenseIssues
GitHubDiscordX