Security and Self-Custody

Self-custody means that no company can recover your wallet or reverse a confirmed transaction. Salmon encrypts key material on your device, but safe use still depends on how you protect your recovery phrase and approve requests.

Recovery phrase

Your recovery phrase controls every account derived from it.

• Keep it offline.
• Never share it with support, a dApp, or another person.
• Do not store it in screenshots, email, cloud notes, passwordless documents, or chat.
• Do not type it into a website to “validate” or “synchronize” the wallet.

If the phrase is lost and no unlocked installation remains, Salmon cannot restore access. If someone else obtains it, changing your local password will not stop them from restoring the wallet elsewhere.

Password and biometrics

Your password encrypts the local vault. Salmon derives an encryption key with PBKDF2-HMAC-SHA512 and protects the vault with authenticated encryption. The vault stores the salt, nonce, and derivation parameters required to unlock it; it does not store the password.

Biometric unlock is a mobile convenience built on the device's secure facilities. It does not replace the recovery phrase or wallet password.

Screen protection

On mobile, screens that display or accept secret material block screenshots, screen recording, and app-switcher previews. This reduces accidental exposure but cannot protect against another camera or a compromised device.

Before approving an action

Check:

• The active account and network.
• The requesting application and domain.
• The asset, amount, recipient, and fee.
• Whether the request is a transaction, a login, or a message signature.
• Whether the result matches the action you intended.

A message signature can prove control of an address. It should not transfer funds by itself, but it can still authorize access to a service. Reject requests you do not understand.

If something looks wrong

1. Reject the request.
2. Disconnect the dApp and remove it from Trusted apps.
3. Lock Salmon.
4. If the recovery phrase may be exposed, create a new phrase in a trusted environment and move assets to addresses derived from it.

For private vulnerability disclosure, use the process in the relevant repository's SECURITY.md. For ordinary support, start from salmonwallet.io and never include secret material. See the FAQ for recovery and support boundaries.