Security Considerations

This document covers security considerations for users and developers of SHIELD.

For Users

Link Security

The secure link is the only way to access encrypted content. Treat it accordingly:

Copy Immediately

The link is only shown once. Screenshot or copy it immediately.

Share Securely

Don’t post links publicly. Use private channels (DMs, encrypted email).

Verify Recipient

Double-check the wallet address before creating a policy.

Set Reasonable Limits

Don’t set 1-hour expiration for someone in a different time zone.

Wallet Security

Your wallet is your identity on SHIELD:

Never share your private key or seed phrase
Verify transaction details before signing
Use hardware wallets for high-value accounts
Check the URL is app.shieldhq.xyz before connecting

Phishing Protection

Watch for these red flags:

Legitimate	Phishing
URL: `app.shieldhq.xyz`	URL: `shield-app.xyz`
Asks for SIWE signature	Asks for private key
Shows policy before signing	Signs unknown transaction
HTTPS with valid certificate	Certificate warnings

Content Visibility

Understand who can see what:

Before sharing: Only you (encrypted on your device)
During sharing: Only link holder (encryption key in URL)
After access: Recipient has plaintext (save it if needed)
On-chain: Only access metadata, never content

For Developers

Environment Variables

Never commit these to version control:

# .env
POSTGRES_URL=postgresql://... # Database connection
PINATA_JWT=eyJ...             # IPFS pinning
JWT_SECRET=...                # Session signing
BASE_RPC_URL=...              # Base RPC endpoint

Use:

.env.example for documentation
.env.local for local development (gitignored)
Platform env vars (Vercel, etc.) for production

Database Security

PostgreSQL security checklist:

API Security

Rate limiting is implemented:

// Default limits
const RATE_LIMITS = {
  createPolicy: '10 per minute',
  accessContent: '5 per minute',
  auth: '20 per 5 minutes',
  default: '100 per minute'
};

Customize in src/lib/rateLimit.ts.

Smart Contract Security

Shield contract security features:

// Access control
require(msg.sender == policy.recipient, "Unauthorized");

// Replay protection
require(policy.attempts < policy.maxAttempts, "Max reached");

// Time validation
require(block.timestamp < policy.expiry, "Expired");

// State validation
require(policy.valid, "Policy invalid");

Content Validation

Before uploading to IPFS:

Validate file size limits
Check MIME type if needed
Scan for malware (if required)
Sanitize filenames

Dependency Security

Keep dependencies updated:

# Audit dependencies
npm audit

# Check for known vulnerabilities
npm audit --audit-level high

# Update regularly
npm update

Deployment Security

Vercel Security

Enable Vercel Authentication for deployments
Use Production Branch Protection
Enable DDoS Protection
Configure Custom Headers for security

Database Security (Neon)

-- Create read-only user for API
CREATE USER shield_api WITH PASSWORD '...';
GRANT CONNECT ON DATABASE shield TO shield_api;
GRANT USAGE ON SCHEMA public TO shield_api;
GRANT SELECT, INSERT ON ALL TABLES IN SCHEMA public TO shield_api;

Contract Deployment

Best practices:

Test on Sepolia first
Verify source code on BaseScan
Use multisig for admin functions
Document the deployment

Incident Response

Reporting Security Issues

Found a vulnerability? Contact us:

Email: shieldencrypted@gmail.com
PGP: Key
Bug Bounty: HackerOne

What to Include

Description of the issue
Steps to reproduce
Potential impact
Suggested fix (if any)

We aim to respond within 48 hours.

Known Limitations

Frontend Trust

Users must trust the JavaScript served by shield.app. Mitigations:

Code is open source (auditable)
Subresource Integrity (SRI) headers
Content Security Policy (CSP)

Browser Security

Encryption happens in the browser, which:

Could have malware
Could be using outdated browser
Could have malicious extensions

Users are responsible for browser security. Technical security can’t prevent:

Sending to wrong address (typo)
Sharing link publicly
Falling for phishing sites

User education is essential.

Security Checklist

Before going to production:

​Security Considerations

​For Users

​Link Security

Copy Immediately

Share Securely

Verify Recipient

Set Reasonable Limits

​Wallet Security

​Phishing Protection

​Content Visibility

​For Developers

​Environment Variables

​Database Security

​API Security

​Smart Contract Security

​Content Validation

​Dependency Security

​Deployment Security

​Vercel Security

​Database Security (Neon)

​Contract Deployment

​Incident Response

​Reporting Security Issues

​What to Include

​Known Limitations

​Frontend Trust

​Browser Security

​Social Engineering

​Security Checklist