SECURITY BASELINE / 2026-08-14Read-only first.
Read-only first.
Verifiable by design.
This page states what is protected today, what is intentionally unavailable, and what has not yet been independently certified.
01 / ACTIVE CONTROLS
Controls running in production
These controls are implemented in the application or provided by the hosting platform.
Read-only boundary
A public wallet address is the only portfolio input. Mozi never requests a seed phrase, private key, wallet signature or trading permission.
Strict input validation
Wallets must be non-zero EVM addresses. Funding and logo queries are normalized, length-limited and restricted to supported identifiers.
Fixed upstream allowlist
Server requests go only to venue and data-provider endpoints defined in code; visitors cannot supply an arbitrary upstream URL.
Browser isolation
CSP, anti-clickjacking, MIME protection, referrer controls and restrictive browser permissions are sent on every route.
Server-only secrets
VOOI, database and cron credentials stay in server environment variables and are never included in browser responses.
Protected refresh job
The funding refresh endpoint requires a constant-time checked bearer secret and preserves the last verified snapshot if refresh fails.
Minimal public errors
Public APIs return stable generic failures while detailed diagnostics remain in server logs.
Platform protection
Automatic HTTPS, HSTS and Vercel platform DDoS mitigation protect the public deployment without a paid security add-on.
02 / STANDARDS MAP
Recognized references, honest status
Alignment is not the same as independent certification. Each status below is deliberately scoped.
Baseline mappedOWASP ASVS 5.0
Selected Level 2 application controls guide the current hardening work. A formal independent assessment has not yet been completed.
Open official standard Threat checklistOWASP Top 10:2025Used to review access control, configuration, supply-chain, cryptography, injection, integrity, logging and error-handling risks.
Open official standard Process referenceNIST SSDF 1.1Used as the secure-development reference for dependency review, change verification and vulnerability response.
Open official standardCREDENTIAL BOUNDARY
Aster remains connection-required
Mozi does not collect Aster USER_DATA credentials in the current release. A future connection must use narrowly scoped credentials, encryption, revocation and a separate security review before launch.
03 / RESPONSIBLE DISCLOSURE
Found a security concern?
Report it privately to the Mozi project owner through the official channel where you received this product. Include the affected URL, reproducible steps and impact. Do not publish secrets, wallet credentials or exploit details publicly.