Found something? Tell us first.

What Desk is

Desk is a native iOS app for trading perpetuals on Monad. Both of its keys are derived on the phone from a passkey. The wallet key that moves AUSD is made again for each transaction and never stored. The order key, which can place and close orders but can’t withdraw, is sealed in the iOS keychain so only this iPhone’s current Face ID opens it. Neither key is ever sent anywhere.

The server side, at trydesk.trade, reads public chain data, quotes swaps, sends push notifications and runs a worker that indexes wallet history. It holds credentials for third-party data services and for a testnet faucet, and nothing that could move a real person’s money. The public API is read-only.

In scope

• trydesk.trade — the site and every route under /api.
• The iOS app — key handling, Face ID gating, order signing, deep links and the alerts registration.
• The indexing worker on Railway and the way it writes to the store.
• Anything in the open repository that ships to the above.

We care most about: a way to make the app sign something the person did not see; a key or seed leaving the phone; a server credential exposed; one person’s alerts, follow list or tracked wallets being read or rewritten by another; and the API returning private data it should not hold.

Out of scope

• Rate-limit exhaustion, enumeration of public addresses, or anything whose only effect is more requests.
• Public chain data being public: positions, balances, ledgers and names on Monad are visible to everyone by design.
• Third parties we read from or run on: Monad RPC, Perpl, OKX, nad.fun, Neynar, Vercel, Railway, Upstash. Report those to them.
• Missing or “best practice” headers, TLS configuration notes, version disclosure and other reports with no demonstrated impact.
• Denial of service of any kind.
• Phishing, social engineering of us or of users, and physical attacks.

Rules

• Do not access, change or delete data that is not yours. If a test unexpectedly reaches someone else’s data, stop, note what you saw, and tell us.
• Use your own wallets and test accounts. Do not trade with, or against, anyone else’s.
• Report privately, through the link below, and give us time to fix it before saying anything publicly.
• Do not run automated scanners against production at volume; the rate limits are there for the people using the app.

Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorised. We will not pursue or support legal action against you for it, we will work with you to understand and fix the issue quickly, and we will not ask you to sign anything to report. If a third party takes legal action against you for activity conducted in line with this policy, we will make it known that you acted under it.

This policy does not authorise anything against systems we do not own. If you are unsure whether something is covered, ask first.

What we do

• Acknowledge your report within 3 business days.
• Confirm the issue, agree a severity with you, and tell you what we intend to do.
• Fix targets by severity: anything that can move funds or sign without consent, as fast as we can, usually days; exposure of a server credential or of one person’s data to another, within two weeks; everything else, within 90 days.
• Tell you when it ships, and agree disclosure with you.

Rewards

No monetary bounty at this time. With your permission we credit you in the release notes and in the repository.

How to report

Open a private security advisory on GitHub: github.com/frankolien/desk/security/advisories/new. Only maintainers can read it. Include what you found, how to reproduce it, and what you think it lets an attacker do. A proof of concept against your own accounts is welcome; one against anyone else’s is not.

The same contact is published at /.well-known/security.txt.