Back to dashboard

Security

How we keep your wallet and data safe.

Why Your Funds Are Safe

Connecting your wallet to DLMM Alert is as safe as viewing your wallet on Solscan. Here's exactly why.

We never request transaction approval

DLMM Alert never asks you to sign a transaction. Your wallet connection is read-only — we use the Solana Wallet Adapter standard library to read your public key and view on-chain positions. That's it. There is no smart contract, no token approval, no transfer instruction. It is technically impossible for this app to move, spend, or access your tokens.

No private keys, no seed phrases — ever

Your private key never leaves your wallet (Phantom, Solflare, Backpack, etc.). We only receive your public address — the same address anyone can look up on Solscan. We couldn't steal funds even if we wanted to, because we never have the key required to sign a transaction.

No smart contract interaction

Unlike most DeFi dApps, DLMM Alert does not deploy or interact with any smart contract. We read publicly available on-chain data (your DLMM positions) the same way any block explorer does. There is nothing to exploit, no approval to revoke.

Infrastructure & Trust

Built on the same battle-tested infrastructure used by the biggest names in Solana and beyond.

Solana Wallet Adapter

The same open-source wallet connection library used by Meteora, Jupiter, Raydium, Marinade, Tensor, and virtually every major Solana dApp. Developed and maintained by Solana Labs. Audited and battle-tested across billions of dollars in TVL.

Also used by: Meteora, Jupiter, Raydium, Marinade, Tensor, Magic Eden

Helius RPC

On-chain data is fetched through Helius, one of Solana's most trusted RPC providers. Helius powers infrastructure for top-tier protocols and processes billions of requests daily. All connections are encrypted via TLS.

Also used by: Jupiter, Tensor, Helium, DRiP, Crossmint

Meteora DLMM SDK

Position data comes directly from Meteora's official @meteora-ag/dlmm SDK and their public Data API. We read the same data you see on app.meteora.ag — bin ranges, active bins, unclaimed fees, and PnL. No custom smart contract calls.

Also used by: Meteora (official SDK)

Dialect Protocol

Telegram notifications are delivered through Dialect, Solana's native messaging protocol. You subscribe via a wallet signature (not a transaction). Dialect is used by major Solana protocols for on-chain messaging. No email, phone number, or personal data required.

Also used by: Marinade, Tensor, Dialect ecosystem dApps

Supabase

Your monitoring preferences and alert history are stored on Supabase (built on PostgreSQL) with Row Level Security (RLS) policies. Data is encrypted at rest and in transit. Supabase is SOC 2 Type II compliant and used by thousands of production applications.

Also used by: 1Password, Mozilla, Pika, Humata AI

Vercel

The app is hosted on Vercel, the platform behind Next.js. Automatic HTTPS, DDoS protection, edge caching, and SOC 2 compliance. Used by some of the largest web applications in the world.

Also used by: Washington Post, Under Armour, Nintendo, Notion

Security Measures

Technical security hardening applied across the application.

  • Security headers (CSP, X-Frame-Options, HSTS, Referrer-Policy) on every response
  • Rate limiting on all API endpoints to prevent abuse
  • Input validation on all server-side routes (wallet address format, payload structure)
  • API keys are server-side only — never exposed to the browser
  • Fetch timeouts on all external API calls to prevent resource exhaustion
  • Console logs stripped in production — no wallet addresses or sensitive data in logs
  • No cookies, no sessions, no tracking — your wallet address is your only identifier
  • Cron endpoints protected by secret-based authentication
  • Notifications route to your wallet only — no cross-user data leakage