Scope
In scope
Key storage, seed import, hardware-wallet signing, transaction construction, RPC handling, update checks, checksum manifests, and desktop packaging.
Security
Security policy and release verification.
A clear place for vulnerability reports, supported versions, checksum verification, and safe installation habits.
Security policy
Report privately, protect users first.
If you find a vulnerability that could affect funds, private keys, transaction signing, update delivery, or release integrity, report it privately through the official repository security advisory flow before publishing details.
Disclosure
Coordinated timeline
Include reproduction steps, affected versions, expected impact, logs with secrets removed, and suggested fixes. Public disclosure should wait until users have a patched release path.
Out of scope
Non-wallet issues
Spam, social engineering, unrelated World services, exchange availability, token price movement, or issues caused by modified third-party builds are outside this policy.
Verify checksums
Confirm the binary before opening it.
Every release should publish SHA-256 hashes for macOS, Windows, and Linux artifacts. The downloaded file hash must match the signed release manifest exactly.
macOS
SHA-256 and signature
Run shasum against the disk image or archive, then verify the app signature before first launch.
shasum -a 256 WLD-Wallet-2.5.11-mac.dmg
9075eacb80b5064db240955934836b08d90c95156d3637de6bc9705e724fbac9
Windows
Hash and publisher
Compare the installer digest and check that the publisher signature matches the expected release identity.
Get-FileHash .\WLD-Wallet-2.5.11-win-portable.exe -Algorithm SHA256
9daacdbd15a9b9901a58188e8d32ad83311f62c9a3108e564a49e75328cd8728
Linux
Digest before chmod
Verify the AppImage or archive hash before making it executable or moving it into your app directory.
sha256sum WLD-Wallet-2.5.11-linux.AppImage
da9f161952630287bbd324e5d1d86fd4a57ad8ff41c9638c8e919b2aad00755c
If a checksum, signature, filename, or download source does not match the release notes, delete the file and download again from the official release page.
Verify before importing keys.
Install only verified builds. Check the release source, digest, and publisher signature before importing a seed phrase or connecting hardware wallets.
Keep signing explicit.
Review chain, recipient, token contract, amount, gas estimate, and nonce before approving. Reject any prompt that appears after visiting an unrelated site or opening an unknown file.
Treat backups as live funds.
Store recovery phrases offline. Do not photograph, cloud-sync, email, paste, or send them to anyone claiming to provide support.