How Gleam handles security.

Our code is open

You can read every line of Gleam's code on GitHub.

All code changes must pass multiple checks

Every change must pass a pull request and our automated checks before it can be merged.

• Gitleaks checks for passwords and secret keys accidentally committed to the code.
• OSV-Scanner checks our dependencies against a database of known vulnerabilities.
• GitHub Dependency Review flags new dependencies with known vulnerabilities.
• Semgrep scans our code for risky patterns.
• zizmor checks our GitHub Actions workflows for security issues.
• Mozilla web-ext checks the finished extension for common problems.
• Automated tests check that the wallet behaves as expected. Playwright also runs the wallet in a real browser.

Every release gets a security review

Before each release, an AI security review checks every change to the code that handles keys, and we publish the results. If a serious issue is still open, our release pipeline refuses to ship.

Releases you can verify

Every release is built from a signed, approved version of our code.

• Restricted build environment. StepSecurity limits which websites our build machine can connect to.
• Proof of origin. Each build gets a signed record showing where it came from. Anyone can check this against our published releases.
• Secure update signing. We use a securely stored private key to sign Gleam extension updates, helping the Chrome Web Store verify they come from us.

Incentivised public reviews

We invite the public to review each release and publish every review. Confirmed bugs earn a share of our bounty pool.

Hardware wallet support

Connect a Ledger or Keystone for maximum security. Your private keys stay on your hardware.

Clear language in plain UX

Every request from an app opens its own approval window. Gleam explains the transaction in plain language before you agree to anything.

Your keys stay encrypted

Your keys are locked with your password or passkey and are never stored in plain form. Gleam also locks itself automatically when you step away.

An anti-phishing phrase

You choose an anti-phishing phrase during setup that appears before important actions. If a window asks for your password or signature without it, it isn't Gleam.