houseSecurity at house
On-chain games hold real keys and real value, so security is part of the design from the first line of code.
This page lists the practices we follow and how to report a problem.
What we do
- Keys never on application servers
- Wallet keys are generated and held in secure enclaves. Our services hold API credentials that can ask for a signature, and the enclave decides.
- Narrow, revocable credentials
- Each service has its own credential and signing policy. Any credential can be revoked and replaced in minutes without touching the wallets.
- Two approvers for rule changes
- Changes to users, credentials or signing policies need two of three approvers. No single key can rewrite the rules.
- Checked signatures and spending caps
- Every signed transaction is checked against what we asked for, and outgoing value has hourly and daily limits.
- Sessions we cannot leak
- Session tokens are stored only as keyed hashes, and real-time connections close the moment a session is revoked.
- Least-privilege data access
- Each service connects to the database with its own role and only the permissions it needs.
- Edge protection
- Traffic passes through Cloudflare. Our servers only accept requests that carry a secret header added at the edge.
- Independent reconciliation
- Automated jobs compare our ledger with on-chain records and flag anything that does not match.
- Audit trail
- Operator actions are written to a tamper-evident audit log.
Report a vulnerability
If you find a security issue in anything we run, email support@house.cash with "Security" in the subject line.
Please include what you found, the steps to reproduce it, and what an attacker could do with it.
Please do not access or change other people's data, disrupt our services, or share the issue publicly before we have had a reasonable chance to fix it.
We will acknowledge your report, keep you updated while we work on it, and credit you if you would like.
Further reading
Follow the build
Releases, updates and new write-ups go out on X first.