What we can stand behind
Kadia is unaudited and in development. This page says what the apps and this site do today, and nothing more.
Audits
No audit reports are published. If an audit is completed, its report will be linked here with its scope and date. Until then, treat all Kadia software as unaudited.
This website and the apps
- Static files with no third-party scripts, fonts or trackers, and no cookies or analytics.
- A strict content security policy: no inline or remote code, and the apps talk only to the site that serves them.
- The lending app runs one WebAssembly module. It must match a pinned hash before it runs, and it can't reach the page, the network or the clock.
- Reproducible builds: anyone can rebuild the apps and compare every file's hash.
- No Kadia app ever asks for a seed phrase or a private key, and none ever will.
Wallets and signing
- Keys stay in your wallet. A wallet connects only when you choose it.
- Every action stops at a plain-language review before anything is signed.
- Before sending, the app checks that the wallet signed exactly the transaction it built.
- Signing is turned off in today's builds. Nothing can be sent from them.
Reporting a problem
A security contact and a disclosure policy haven't been published yet. They will appear here, and in this site's security.txt, once they exist.