> For the complete documentation index, see [llms.txt](https://doc.lockerprotocol.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.lockerprotocol.com/reference/security-model.md).

# Security model

What lives on which device, and what the extension can never do.

## The one idea

**Private keys exist only on the Vault, and the Vault never has a network.** Everything else follows from that.

## What lives where

|                                            | Vault (offline)                      | Extension (online)                   |
| ------------------------------------------ | ------------------------------------ | ------------------------------------ |
| Secret phrases and private keys            | ✅ encrypted with the master password | ❌ never                              |
| Addresses                                  | ✅                                    | ✅ (watch-only)                       |
| Balances, prices, activity                 | ❌                                    | ✅                                    |
| Connected sites, custom networks, contacts | ❌                                    | ✅                                    |
| Signature journal                          | ✅ encrypted                          | ❌                                    |
| Hyperliquid agent key (trade-only)         | ❌                                    | ✅ encrypted with the wallet password |

## What each side can and cannot do

**The extension can:** show your accounts, prepare transactions, ask the Vault to sign, broadcast signed transactions, talk to websites. **It cannot:** sign anything on its own, export a key, or recover funds.

**The Vault can:** create and store keys, decode and display a request, sign it, keep a journal. **It cannot:** go online, broadcast, see balances, or recover a forgotten master password.

## Defenses in depth

* **Air gap.** Only QR images cross. A compromised computer can lie on its screen but cannot reach the keys.
* **Independent decoding.** The Vault decodes every request itself and shows it in its own words. The extension's display is *transport only*.
* **Risk analysis on both sides.** Phishing list, look-alike addresses, unlimited approvals, account handovers, chain mismatches. Danger locks signing behind an explicit acknowledgement.
* **Request binding.** A signature answers one request id; an old signature cannot be replayed for a new request.
* **Encryption at rest.** Master password on the Vault (14+ chars, mixed), optional password on the extension, auto-lock on both.
* **Self-destruct.** 50 wrong master passwords in a row erase the Vault.
* **Blurred camera previews.** Neither screen ever shows a readable code from the camera.
* **Reproducible builds.** The store package can be rebuilt bit-for-bit from the source. See [Reproducible build](/reference/reproducible-build.md).
* **No CDN at runtime.** The extension ships all its code and fonts; it does not load scripts from the internet.

## What is still on you

* Keep the Vault offline. The red banner tells you if it is not.
* Read the Vault's screen before tapping **Sign**.
* Keep the paper backup safe; nobody can restore an account for you.
* Do not give your phrase, keys or passwords to anyone. Ever.

## Reporting a vulnerability

See the `SECURITY.md` file in the extension repository for the disclosure process, or reach us on [Discord](https://discord.gg/tcNRmMTHp5).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://doc.lockerprotocol.com/reference/security-model.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.