> For the complete documentation index, see [llms.txt](https://docs.leather.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.leather.io/wallet-and-security/security.md).

# Security

How Leather protects your wallet, its security audit and bug bounty, and the vulnerabilities fixed in past versions.

## Leather is self-custodial

Leather is a self-custodial wallet. Your keys are created and stored on your own device. Leather has no copy of your Secret Key or your password, so Leather cannot move your assets or recover your keys. Keeping the Secret Key safe is up to you. See [Secure Your Secret Key](/wallet-and-security/secure-secret-key.md).

## Security features in Leather

* **Lock:** locks Leather in every open window until you enter your password. See [Lock and Unlock Wallet](/get-started/lock-and-unlock-wallet.md).
* **Separate accounts:** one wallet can hold many accounts, for example one for daily use and one for testing. See [Add or Restore Accounts](/get-started/add-or-restore-accounts.md).
* **Ledger support:** keep your keys on a Ledger device and approve each transaction on it. See [Connect Leather with Your Ledger Hardware Wallet](/get-started/connect-ledger.md).
* **Secret Key behind your password:** Leather shows the Secret Key only after you enter your password. See [View Secret Key](/get-started/view-secret-key.md).
* **Migration:** if your Secret Key is exposed, move your assets to a new wallet. See [Migrate Assets Between Wallets](/get-started/migrate-assets-wallets.md).

## Audit and bug bounty

Least Authority audited the wallet in 2021, when it was the Hiro Wallet and was about to launch as a browser extension. The [audit report](https://github.com/leather-io/extension/blob/dev/public/docs/least-authority-security-audit-report.pdf) is public.

Leather ran a bug bounty with HackerOne from 2023 to 2026. Since August 2026 the bug bounty runs on [Immunefi](https://immunefi.com/bug-bounty/leather/information/).

Leather's source code is open. Community contributors have reported several of the issues below.

## Vulnerabilities fixed in past versions

### August 2023: Secret Key cached by the browser

Reported August 8, 2023. Fixed August 10, 2023, in version 6.3.1.

The "import wallet through Secret Key" form used a `textarea` field. Browsers could cache its content, so someone with access to the computer could find the Secret Key in browser storage. [The fix](https://github.com/hirosystems/wallet/commit/108fdf865e00b545f29f8fca15e7a7869a8da097) stopped the browser from caching the field.

### December 2022: wallet stayed unlocked in other tabs

Reported December 4, 2022. Fixed December 5, 2022 for Chrome and January 25, 2023 for Firefox.

Locking the wallet in one tab left it unlocked in other open tabs and windows. Someone with physical access to the computer could use it. [The fix](https://github.com/hirosystems/wallet/pull/2917) locks the wallet in every tab and window.

### July 2022: appPrivateKey exposure

Reported and fixed July 7, 2022, in version 3.11.2.

Before version 3.11.2, approving a malicious authentication request could give an attacker the `appPrivateKey` of any domain. No exploit was known. [The fix](https://github.com/hirosystems/stacks-wallet-web/pull/2545) validates the `redirect_uri` value, so only the requesting origin's domain is passed to the `@stacks/wallet-sdk` library.

### April 2021: password in memory in the desktop wallet

Reported April 9, 2021. Fixed May 5, 2021.

The desktop wallet kept the password in memory as plain text. After a user checked their Stacks address, a memory dump showed the password and the address. The desktop wallet is now archived.