# Wallet Checker Security

## Seed phrase handling

- Mnemonics are entered and validated in the browser.
- BIP39 seeds, HD keys, private keys, and derived addresses are calculated locally in the browser.
- The wallet checker server accepts only `GET` and `HEAD` requests for static files and `/health`.
- The server does not accept mnemonic phrases, private keys, or wallet balances in request bodies.
- The server does not log request URLs, query strings, headers, mnemonics, or addresses.

## Balance providers

When live balances are enabled, the browser sends public wallet addresses directly to the selected public provider. A provider can see the public address used for its request, but the mnemonic and private keys never leave the browser.

Provider requests may be affected by CORS, rate limits, outages, or API terms. The Fuel panel reports failures and rotates to another configured provider. Never enter a seed phrase into a custom provider that you do not trust.

## Transport security

For local testing, the included server uses HTTP on the local network. HTTP does not encrypt traffic between devices. For use outside a trusted local network, place the server behind HTTPS with a trusted certificate and a firewall. Do not expose the development server directly to the public internet.

## Operational guidance

- Use a trusted computer and browser.
- Do not share screenshots containing seed phrases or private keys.
- Clear the page after use and close the browser tab.
- Keep the local project and dependencies updated.
- Treat every derived address as public, but treat the mnemonic as a wallet master secret.