Security

The custody model

Custody is the question of who can move your money. The answer here is you, and only you, at every point in the flow.

What we never ask for

• Your seed phraseNever, on any screen, for any reason. Not for support, not for recovery, not to import a wallet, not to verify anything.
• Your private keyThe connected wallet signs through the adapter. Handing over a key is never part of any flow here.
• A depositYou fund wallets you control. You never send anything to us.
• Remote accessNobody from RELICLAUNCHER will ask to control your screen or your machine.

How keys are handled

• GenerationBuy wallet keypairs are created in your browser using the browser's own cryptographic random source.
• StorageThey live in the browser's storage on that machine. Clearing site data removes them permanently, so export before you clear if you want to keep them.
• SigningTransactions for generated wallets are signed in the page. The transaction leaves. The key does not.
• ExportExporting hands you the raw keys. From that moment their safety is entirely a question of where you put them.
• DisposalSweep first, then clear. A wallet with nothing in it is still a key someone can find later, and the account may still hold rent.

The honest limit

Local generation means no server sees your keys. It does not mean nothing can. A browser extension you installed and forgot about can read what the page reads. So can malware on the machine. If a launch is large enough to matter, run it from a browser profile with nothing else in it, on a machine you keep clean.

Recognising an impersonation

Launch tools attract fakes, because the people using them are moving real money and are often in a hurry. The pattern is always the same and it is easy to spot once you know it.

1. 01

   Check the address bar, not the link

   A link can say anything. Read the actual domain in the address bar, character by character. Substituted letters and extra words are the whole trick.

2. 02

   Distrust urgency

   Real infrastructure does not need you to act in the next two minutes. Urgency exists to stop you checking.

3. 03

   Refuse every seed phrase request

   There is no legitimate context for it. None. This single rule stops most of what is out there.

4. 04

   Verify support through a channel you already had

   Support does not arrive first. Anyone who messages you unprompted offering to fix a launch is not support.

5. 05

   Read what you are signing

   A wallet showing an approval for something you did not initiate is the last warning you get. Reject it.

Practical habits

• Use a launch walletConnect a wallet that holds what the launch needs and nothing more. Your long term holdings do not belong in the same wallet as your launch fees.
• Simulate every timeSimulation is the cheapest verification available and it costs nothing at all. It is also where a wrong address gets caught.
• Check the mint address twiceEspecially when launching against an existing mint. Tickers repeat. Addresses do not.
• Keep the confirm step onAlways seeing the full cost breakdown before signing is what makes an unexpected number visible.
• Sweep promptlyFunds left in generated wallets are funds in wallets you are no longer paying attention to.

Reporting something

If you find a security issue in RELICLAUNCHER, report it before disclosing it publicly and give us a chance to fix it. If you find a site impersonating us, report it too, so the next person who searches for us does not find it first.