Security

Report a problem

Found a bug, or a way this app could be misused? Reach out below — every report gets read.

What Lamport never does

• Never asks for a seed phrase or a private key.
• Never signs or sends a transaction — your wallet does, after you approve it.
• Never stores a key, a password, or a copy of your wallet's private data, anywhere.

Check the address bar

Before connecting a wallet or approving anything, check the address bar. Bookmark the real site and use that bookmark, rather than a search result or a link from chat or social media.

Signing in is tied to this domain

Signing in uses Sign In With Solana, which includes this site's domain in the message your wallet signs. Your wallet checks that the domain matches before it lets you sign — a copy of this site hosted elsewhere can't reuse a sign-in meant for the real one.

No bug bounty

There is no paid bug bounty program right now. A responsible report is still read and appreciated.