Security model
Know exactly where
the trust boundary sits.
Aura is self-custodial. The app helps you manage keys, but it cannot restore them for you if your backup is lost.
Keys and signing
Recovery phrases, passphrases, and private keys are generated and used on-device. Transaction construction and signing happen inside the application.
Encrypted local storage
Wallet records are encrypted before they are persisted. The device key used by the application is protected by the system keychain.
Network visibility
Aura connects to Electrum servers using wallet scripthashes. A server can observe the requests it receives, so advanced users may choose a server they trust.
Optional fallback
Direct address queries to mempool.space are disabled by default and require the user to enable them.
Security reports
Please do not publish sensitive vulnerabilities in a public issue. Use GitHub’s private vulnerability reporting path.
Aura does not currently claim a published independent security audit. Open source and automated checks improve transparency, but they are not a substitute for an independent audit.