Arqma Wallet audits & disclosure

Our security posture, in one paragraph

Arqma Wallet is open source. The build is reproducible. The cryptography is the same family Monero uses, which has had hundreds of researcher-hours poured into it. We publish releases with SHA-256 checksums and maintain a public issue tracker. When something is found, we fix it and tell users honestly.

Open source — what that buys you

Every line of code that runs in Arqma Wallet is publicly readable. You don’t have to take our word for what it does — anyone with the relevant skill can verify it themselves. That includes:

• Independent developers who fork or audit the code.
• Security researchers looking for bugs.
• You, if you’re curious.

This is a much stronger guarantee than “trust us, we’re secure.” You benefit even if you never read a line, because someone with motive and ability could.

Reproducible builds

The build process is documented and reproducible: someone with the same source code and tools can produce a binary that matches our published releases byte-for-byte. That means anyone can verify that the binary on our download page was actually built from the public source, not from some private patched fork.

Foundation: Monero cryptography

Arqma is a fork of the Monero codebase and inherits the well-studied CryptoNote/RingCT cryptography. That family of primitives has been the subject of academic papers, professional audits, and continuous community review for over a decade. We get to stand on that foundation rather than invent our own.

Audits and reviews

The Arqma Wallet codebase is reviewed by independent community contributors with cryptographic and software security experience. Where formal third-party audits have been performed, the reports are linked from the project’s GitHub. As with any honest project, we’d rather tell you a finding exists than pretend it doesn’t.

Vulnerability disclosure

If you believe you’ve found a security issue in Arqma Wallet, please report it responsibly:

1. Do not disclose publicly first. A public 0-day puts users at risk before they can patch.
2. Reach out via the community channels — the maintainers’ contact details are pinned in the project’s GitHub README.
3. Provide a clear reproduction, the affected versions, and the suspected impact.
4. We acknowledge within a few days, work on a fix, and coordinate disclosure with you.

If your finding is genuinely novel, we’ll credit you in the release notes (unless you prefer to stay anonymous).

What we’re transparent about

• Code: public on GitHub. Every commit, every issue, every release.
• Releases: announced with changelogs and SHA-256 checksums.
• Known issues: tracked publicly in the issue tracker.
• Disclosures: resolved security issues are summarised in release notes.
• Trade-offs: we tell you when a feature is convenient at the cost of safety (the web wallet page is a good example).

What you’re responsible for

Audits and open source matter, but most real-world losses are user-side. The basics still apply:

• Download Arqma Wallet only from our official download page.
• Verify the SHA-256 checksum before installing.
• Write the 25-word seed phrase on paper. Two copies, two locations.
• Never paste the seed into anything that isn’t the wallet itself.
• Keep the device the wallet runs on patched and clean.

An audited wallet on a compromised laptop is still a compromised setup. See is Arqma Wallet safe? for the full breakdown.