Documentation Index

Fetch the complete documentation index at: https://docs.shieldhq.xyz/llms.txt

Use this file to discover all available pages before exploring further.

​

Security Considerations

​

For Users

​

Link Security

​

Wallet Security

• Never share your private key or seed phrase
• Verify transaction details before signing
• Use hardware wallets for high-value accounts
• Check the URL is app.shieldhq.xyz before connecting

​

Phishing Protection

​

Content Visibility

• Before sharing: Only you (encrypted on your device)
• During sharing: Only link holder (encryption key in URL)
• After access: Recipient has plaintext (save it if needed)
• On-chain: Only access metadata, never content

​

For Developers

​

Environment Variables

# .env
POSTGRES_URL=postgresql://... # Database connection
PINATA_JWT=eyJ...             # IPFS pinning
JWT_SECRET=...                # Session signing
BASE_RPC_URL=...              # Base RPC endpoint

• .env.example for documentation
• .env.local for local development (gitignored)
• Platform env vars (Vercel, etc.) for production

​

Database Security

• Use connection pooling (PgBouncer)
• Enable SSL/TLS for connections
• Restrict IP allowlist
• Use strong passwords
• Enable query logging
• Regular backups

​

API Security

// Default limits
const RATE_LIMITS = {
  createPolicy: '10 per minute',
  accessContent: '5 per minute',
  auth: '20 per 5 minutes',
  default: '100 per minute'
};

​

Smart Contract Security

// Access control
require(msg.sender == policy.recipient, "Unauthorized");

// Replay protection
require(policy.attempts < policy.maxAttempts, "Max reached");

// Time validation
require(block.timestamp < policy.expiry, "Expired");

// State validation
require(policy.valid, "Policy invalid");

​

Content Validation

• Validate file size limits
• Check MIME type if needed
• Scan for malware (if required)
• Sanitize filenames

​

Dependency Security

# Audit dependencies
npm audit

# Check for known vulnerabilities
npm audit --audit-level high

# Update regularly
npm update

​

Deployment Security

​

Vercel Security

• Enable Vercel Authentication for deployments
• Use Production Branch Protection
• Enable DDoS Protection
• Configure Custom Headers for security

​

Database Security (Neon)

-- Create read-only user for API
CREATE USER shield_api WITH PASSWORD '...';
GRANT CONNECT ON DATABASE shield TO shield_api;
GRANT USAGE ON SCHEMA public TO shield_api;
GRANT SELECT, INSERT ON ALL TABLES IN SCHEMA public TO shield_api;

​

Contract Deployment

1. Test on Sepolia first
2. Verify source code on BaseScan
3. Use multisig for admin functions
4. Document the deployment

​

Incident Response

​

Reporting Security Issues

• Email: shieldencrypted@gmail.com
• PGP: Key
• Bug Bounty: HackerOne

​

What to Include

• Description of the issue
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

​

Known Limitations

​

Frontend Trust

• Code is open source (auditable)
• Subresource Integrity (SRI) headers
• Content Security Policy (CSP)

​

Browser Security

• Could have malware
• Could be using outdated browser
• Could have malicious extensions

​

Social Engineering

• Sending to wrong address (typo)
• Sharing link publicly
• Falling for phishing sites

​

Security Checklist

• Environment variables secured
• Database SSL enabled
• Rate limiting configured
• CORS properly set
• Content Security Policy enabled
• Smart contract verified on BaseScan
• Dependencies audited
• Domain secured (DNSSEC, HTTPS)
• Monitoring alerts configured
• Incident response plan documented