Security practices

Keys#

• Never commit a private key, including Testnet keys: not in code, config files, .env.example, scripts, compose files, docs or tests.
• Load keys from the environment or a secret manager at runtime, and fail loudly when one is missing instead of falling back to a literal.
• Never put any private key in a client bundle (web app, extension, mobile app). Scan your built artifacts before release.
• Treat every Testnet key as exposed. Never reuse one on Mainnet or any other chain, and never send real assets to a Testnet address on another network.

const key = process.env.ZROARUS_TESTNET_KEY;
if (!key) throw new Error("ZROARUS_TESTNET_KEY is not set");

Replay protection#

• Always include chainId: 305583 in transactions (EIP-155). Testnet and Mainnet will have different chain IDs.
• Bind every EIP-712 domain to the chain ID and the verifying contract, and use nonces and deadlines for signed messages. OpenZeppelin's EIP712 recomputes the domain if the chain ID changes.

const domain = {
  name: "YourApp",
  version: "1",
  chainId: 305583,
  verifyingContract: deployments.yourContract, // from your deployment manifest
};

Protecting your users#

• Never ask users for a seed phrase or private key, and say so in your app.
• Label Testnet assets as test assets with no value; never show a price for them or suggest they can be redeemed.
• Anyone can deploy a token with any name. Do not treat a symbol as proof that a token is official.

Reporting vulnerabilities#

Include affected components, reproduction steps and transaction hashes. Never include private keys or seed phrases; the form rejects them.