Security

This page describes how FlowCash is designed to be safe. It doesn't claim more than that. No third-party security audit has been published. When one is, it will be linked here.

Principles

User-controlled wallet. Payouts go to a self-custody wallet. FlowCash has no ability to move funds out of it.

No private-key custody. FlowCash never asks for, stores or generates private keys or recovery phrases — not in the website, not in the desktop app.

Explicit resource permissions. The desktop app only uses resources the person has allowed, within the limits they set, and only while Earn Mode's conditions are met. It isn't designed to read personal files, and workloads will run isolated from them.

Transparent workloads. Every workload will be listed publicly — what it is, who runs it, which resources it uses — before it can run on anyone's computer.

Clear transaction signing. Every onchain action is reviewed in the website before the wallet is asked to sign: amounts, estimated output, minimum output, fees and the number of signatures.

Clear device controls. Earn Mode status, limits and an off switch are always available on the device.

What the website does

• Talks to one network, Robinhood Chain. Wallets on another network are asked to switch before anything is read or signed.
• Validates every response from the desktop bridge and from routing APIs before using it.
• Re-checks each route transaction's chain, target contract, value and amount against what was reviewed.
• Approves exact token amounts only.
• Never reports success before a transaction receipt confirms it.
• Stores only per-browser preferences locally (allocation, pairing token, conversion history). None of it is sensitive.
• Sends standard security headers (X-Frame-Options: DENY, nosniff, a strict referrer policy, a restrictive permissions policy).

The local bridge

The desktop bridge listens on 127.0.0.1 only, answers allowed origins only, validates the Host header against DNS rebinding, and requires a pairing code shown on the device itself before it will share anything. See Desktop bridge.

Things to know

• Routing uses LI.FI's contracts on Robinhood Chain. FlowCash doesn't operate or control them.
• Stock Tokens are issued by a third party and governed by its own terms and contracts, which FlowCash doesn't control.
• The public Robinhood Chain RPC is rate-limited. Production deployments should configure a dedicated RPC endpoint.

Found a security issue? Please report it privately to the team via @useflowcash before disclosing it publicly.