Security Center
How Cova keeps you safe — and what you need to do yourself.
Non-custodial. By design.
You own your keys. We never see them. We cannot touch your funds.
What Cova does
- Build the transaction locally in your browser and hand it to your wallet to sign
- Route swap orders through Jupiter aggregator over public Solana RPC
- Show real-time price, chart, holder, and transaction data from public sources
- Store your UI preferences (theme, watchlist, slippage) in your own browser's local storage
- Collect a transparent 0.5% platform fee on each swap, shown before you sign
What Cova never does
- Store, see, request, or transmit your seed phrase or private keys
- Create hidden transaction approvals, delegate authority, or token allowances
- Auto-execute transactions when your wallet connects
- Store your Google account information on our servers — JWT only, zero account database
- Hold funds in custody. You keep your keys at all times.
Transaction Signing
- Your private keys never leave your wallet extension
- Cova constructs the transaction and hands it to your wallet for review
- You explicitly approve or reject every transaction in your wallet
- Connecting a wallet does not authorize any automatic transactions
- No hidden approvals, token authority changes, or delegate permissions are created
Wallet Security Best Practices
Seed Phrase Protection
Never share your seed phrase or private keys with anyone. Cova will never ask for them. Store your seed phrase offline in a secure location.
Transaction Review
Always review transaction details — recipient address, amount, and platform fee — before approving in your wallet. Verify the contract address matches the intended token.
Hardware Wallets
For large holdings, use a hardware wallet (Ledger). Hardware wallets keep your private keys isolated from your browser and require physical confirmation for every transaction.
Browser Extension Security
Only install wallet extensions from official sources. Verify the publisher. Keep your browser and wallet extension up to date.
Google sign-in = JWT only
Signing in with Google is optional and only used for age verification and session continuity across devices. We use a stateless JWT with Google's OIDC token — your Google account data is never written to a database on our side. We don't run an accounts system.
Risk Warnings
Meme Coin Risks
Meme coins and newly launched tokens carry extreme risk. They can lose most or all of their value rapidly. Low liquidity means you may not be able to sell. Rug pulls and scams are common in this space.
Price Volatility
Cryptocurrency prices can fluctuate dramatically in short periods. Past performance does not indicate future results. Never invest more than you can afford to lose.
Smart Contract Risk
Every token you trade is a separate smart contract that Cova does not control. Even audited contracts can have vulnerabilities. Only interact with verified tokens from trusted sources.
Irreversible Transactions
Blockchain transactions are irreversible once confirmed. Sending to the wrong address or on the wrong network results in permanent loss. Review every detail before signing.
Report an issue
If you discover a security vulnerability or suspicious behavior, report it privately — do not disclose it publicly until it has been investigated and resolved.
Contact
Security reports and issue tracking will be available via the project's GitHub repository once published. For urgent matters during development, contact the project maintainer directly.