Security & Trust

Last updated November 5, 2026.

Velocity with a shield. Velto is built so that the most valuable things you own, your private keys and your API key, never reach us. You should not have to trust us; you should be able to check.

Principles

Non-custodial. Your wallet holds your keys and signs every transaction. Velto never can.
Least data. We collect only what sign-in and support require. See the Privacy Policy.
Screen before you sign. Every on-chain trade passes through Shield before it reaches your wallet.
Verifiable. The code that runs in your browser is served as readable files you can inspect.

Architecture

Component	What it does	What it never touches
Your wallet	Holds keys; shows and signs each transaction you approve	Velto servers never see its keys
Velto front end (your browser)	Displays data, builds transaction previews, stores preferences and your optional Anthropic key locally	Seed phrases or private keys (it never asks for them)
Velto server	Serves the app, handles sign-in sessions, proxies public market data (LI.FI, GoPlus, DexScreener, GeckoTerminal, Kraken), runs Shield checks	Private keys, seed phrases, your Anthropic key, your funds
Anthropic	Answers Claude requests sent directly from your browser with your key	Your wallet
Blockchains	Record transactions you sign	Anything Velto could reverse or redirect

A swap works like this: Velto requests a quote, Shield screens the token, route, and spender, the app shows you a preview, and only then does your wallet ask you to sign. Claude can help prepare a preview, but it has no ability to sign, send, or broadcast anything.

Exact approvals

Many apps ask for "unlimited" token approvals, which let a contract spend your entire balance of a token forever. If that contract is later exploited, every wallet that approved it is exposed. Velto requests ERC-20 approvals for the exact amount of the quote, never unlimited. You can revoke an approval at any time, which sets the allowance back to zero. Always confirm the amount and spender on your wallet's own screen.

The Shield gate

Shield is Velto's real-time fraud protection. Before a swap reaches your wallet, Shield combines:

third-party security data from GoPlus (honeypots, buy and sell taxes, mint or blacklist powers, holder concentration);
Velto's own rules for suspicious routes, spenders, and amounts;
an advisory machine-learning risk score from DEX market behavior, which can only raise a verdict from pass to warn, never lower one.

Shield returns pass, warn, or block. Blocked trades are not sent to your wallet. Shield reduces risk but cannot guarantee safety; see section 9 of our Terms of Service.

Content Security Policy and browser hardening

Velto pages are served with a strict Content Security Policy (CSP), a browser-enforced allowlist that limits where code can load from and where data can be sent:

script-src allows only Velto's own files and exact, version-pinned library files. Injected or third-party scripts are refused by your browser.
connect-src allows only Velto's own server and https://api.anthropic.com (for your BYOK Claude requests). Even if an attacker injected code, the browser would refuse to send data anywhere else.
frame-ancestors 'none' and X-Frame-Options: DENY prevent clickjacking; object-src 'none' and base-uri 'none' close other injection paths.
Referrer-Policy: no-referrer and a Permissions-Policy that disables camera, microphone, geolocation, and payment APIs.

You can read the exact policy yourself: open DevTools, select the Network tab, reload, select the page request, and look at the content-security-policy response header.

Bring your own key: the key stays in your browser

Claude features use your own Anthropic API key. By default the key is held in your browser's session storage for the current tab (cleared when that tab session ends), and in local storage only if you choose “Remember on this device”. It is sent only to api.anthropic.com, directly from your browser. It is never sent to Velto servers. Usage is billed by Anthropic to your account.

Verify it yourself with DevTools

Open the Velto app in Chrome, Edge, Firefox, or Safari and add your Anthropic key in settings.
Open developer tools (F12, or Cmd+Option+I on a Mac) and select the Network tab. Turn on Preserve log.
Send a message to Claude in the app.
In the Network filter box, type the first few characters of your key or x-api-key. Select each request and check Headers and Payload.
You will find the key only in the x-api-key request header of requests to https://api.anthropic.com. Requests to veltorh.trade do not contain it.
Optional: check Application > Session Storage (the default) and Application > Local Storage (only if you chose “Remember on this device”) for this site to see where the key is kept, and delete it there at any time.

Tip: the CSP described above also means that the browser itself would block any attempt by the page to send the key to a host other than Velto's server or api.anthropic.com.

Open, auditable front-end files

Velto's own front-end code is plain, unminified JavaScript, HTML, and CSS served from our own origin, for example /app.js, /app.html, /shield.js, and /app.css. Anyone can open these URLs, or use DevTools > Sources, to read exactly what runs in their browser, including every place the API key is read or sent. The only third-party scripts are two open-source libraries (lightweight-charts and @solana/web3.js) loaded from the unpkg CDN at exact, pinned versions listed in the CSP. Security researchers are welcome to audit them. Attorney review: confirm public repository and license before launch

Security Pledge Attorney review required

If it is ever proven that Velto collected or misused a client's API key or private key, we accept full legal responsibility and will cooperate with law enforcement.

This pledge is part of our commitment to users and is referenced in our Terms of Service. Its final wording and legal effect must be reviewed by a qualified US attorney before launch.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability in Velto:

Email [email protected] with a description, steps to reproduce, affected URLs, and the impact you observed.
Give us reasonable time to fix the issue before public disclosure. We aim to acknowledge reports within 3 business days and to share a remediation timeline within 10 business days.
Act in good faith: do not access or modify other users' data, do not degrade the service (no denial-of-service or high-volume automated testing), do not use social engineering or phishing, and test only against accounts and wallets you own.

We will not pursue legal action against researchers who follow these guidelines in good faith, and we are happy to credit you publicly with your permission. Attorney review: safe-harbor language Machine-readable contact details are available at /.well-known/security.txt.

Protect yourself

Velto will never ask for your seed phrase or private key, by email, chat, phone, social media, or in the app.
Our only official domain is veltorh.trade. Check the address bar before signing in or connecting a wallet.
Read every wallet prompt carefully: the spender, the amount, and the network.
Set a monthly spending limit in your Anthropic console, and revoke your key there if you think it was exposed.
If you shared a seed phrase with anyone, move your funds to a new wallet immediately.