Security
Non-custodial architecture
VertigoPro separates public market data, profile storage and venue signing. Venue funds are not deposited into a VertigoPro wallet. Public data and account read requests can pass through VertigoPro services; usable private signing keys must not.
The current Add account flow is a preview and grants no trading authority. Existing venue sessions and credentials require the distinctions below.
Browser-side signing
The execution implementations sign in the browser and send venue actions to the relevant venue. The Worker does not receive a plaintext wallet or agent private key and does not sign orders. This boundary does not protect a compromised browser: malicious extensions or scripts running with sufficient access can act within an unlocked session.
What VertigoPro receives and stores
This is a description of the implemented data boundary, not an approved privacy or retention policy. Legal retention periods and deletion commitments still require owner review.
Wallet signatures
Read the requested action before signing. VertigoPro sign-in, Hyperliquid ownership verification, agent approval and builder-fee approval have different purposes. A wallet connection by itself does not establish all of them. Reject a request whose domain, account or action differs from what you intended.
API wallets and trading keys
An API signing key can authorise trading actions without repeated main-wallet prompts. Treat it as a sensitive credential even if it cannot withdraw funds. A compromised trading key can still expose an account to unwanted orders and losses.
Hyperliquid’s existing agent implementation encrypts the locally generated key before registration with the Worker. Lighter’s existing adapter holds its signing seed in memory. Neither is backed up by exporting ordinary preferences.
Withdrawal permissions
VertigoPro does not provide a withdrawal workflow in the current terminal. Do not infer a key’s complete venue permissions from a Preview label or an account name. Inspect real approvals at the venue; no withdrawal permission is requested by the preview.
Credential persistence
Ordinary preferences can persist locally and synchronise to a profile. Existing Hyperliquid device credentials use encrypted agent material and a locally unlocked session with expiry checks. Existing Lighter signing seeds are memory-only and are lost when that session ends.
Saved account descriptors and remembered wallet providers do not restore authorisation. Device-bound storage also is not a defence against code already running inside the same browser origin.
Builder-fee authorization
Fee approval is separate from a trading-key approval. It authorises a fee ceiling for the venue’s builder or integrator mechanism; it does not move a deposit. Check the recipient and maximum rate in any real signature request against the fee reference.
Revoking access
- Open the venue’s official application from a trusted device.
- Identify the actual account and API-wallet or key authorisation.
- Revoke the affected venue permission. Consider other sessions that depend on that key before confirming.
- Inspect open orders and positions separately; do not assume key revocation cancels them.
- Remove obsolete local sessions or saved descriptors in VertigoPro.
Forget, Sign out and removing a preview entry do not prove venue-side revocation. Hyperliquid builder-fee approval is a separate permission to review when withdrawing access.
Phishing and support impersonation
Use app.vertigopro.xyz and verify the domain before authenticating. Do not send seed phrases, API private keys, browser session tokens or wallet recovery material to support. A screenshot can disclose addresses, positions and balances; review it before sharing.
Compromised-device checklist
- Stop using the affected browser for signatures and account recovery.
- From a trusted device, inspect venue activity and revoke affected API credentials.
- Check outstanding orders and positions through the venue; respond to unwanted activity there.
- Secure the identity provider used for VertigoPro and terminate suspect provider sessions.
- Remove the compromised browser’s local data and investigate extensions or software before reconnecting.
Clearing browser data is destructive to local preferences and device keys. Export non-sensitive settings first only if the device is safe enough to do so; never delay venue revocation to preserve a layout. If the main wallet itself is compromised, follow that wallet and venue’s recovery process, not merely VertigoPro sign-out.