Vealth · Security and proof

Do not accept a green badge. Run the check.

Evidence you can check with your own browser or your own AI. It does not certify this site, identify who holds a key, or make an irreversible action safe.

Live posture, read by your browser

Press the button and your browser reads how this site protects the connection, right now: encrypted-only access, the rules on what a page may load, protection against framing and content sniffing, and whether the published security contact is current. Each row is one property of the response as your network saw it. A row your browser cannot finish says so, and a quiet server stays neutral, never green.

    What this shows: how the site is set up at this moment, from where you are. It does not prove the site is honest, competent, or safe to send money to. The check reads only this site's own home page and /.well-known/security.txt, follows no redirects, and can never be pointed at somebody else's site.

    Browser safety checks

    The safety page fetches its evidence in your own browser: the settlement contract on Base, the anchor record, and a statement naming this domain, signed by the key that owns our contract. Even an exact copy of that page served from a lookalike domain goes red. Each response can support one named claim, and anything your browser cannot finish is shown as unfinished, never as a pass.

    Safety card

    For AIs and developers

    Read EcoWealth's machine-readable safety card. It lists each claim with the check that tests it.

    The validator, the format, and what it cannot prove

    A validator in the public code repository checks the card's structure and domain binding: npx tsx scripts/safety-card/check-safety-card.ts --from-html apps/web/public/vealth/is-this-safe.html --as-served-from vealth.net. It cannot prove legal identity or that a key is uncompromised. The format is a public spec with a blank template, so any other site can publish its own card, and a card that asserts a verdict is invalid by construction.

    Guard negative-test checklist

    For engineering teams: the guard negative-test checklist gives four steps that prove your automated safety checks really catch what they claim to catch, including the documented exceptions. Every example comes from our own security audit, dated and cited. Like the safety card format above, it is written so another team can run the same steps against their own code.

    Proof registry

    Check a proof of who had a file first yourself. A matching fingerprint (a hash, a short code made from the file) shows that a particular file existed before the recorded date. It does not prove the file is true, complete, or written by a particular person. Recording a fingerprint is free, and checking is never put behind a paywall.

    Security contact

    Read security.txt. It publishes a contact and a policy location; it is not an audit, warranty, or promise of a reply time. The same facts in plain language, with scope and what to expect: how to report a security issue.

    The same laws, pointed at places

    This page is the digital side of one family. The other side is the Vealth Standard, where a place holds a Standing computed only from settled work with accepted proof, recomputed on every read and lapsing when the work stops. The same rules apply to both: the receipt is the certificate, and nothing asserts a verdict a visitor cannot recompute. Digital provisioning is the upkeep loop that keeps a digital estate in good order under those rules.

    What none of this proves

    A seal that implies more than it proves is worse than no seal, so here is the limit. None of this stops anyone clicking a bad link. The domain binding proves that the holder of a key named this domain, not who the holder is and not that the key was never stolen. An anchored hash proves bytes existed by a date, not that they are true. Passing connection checks prove how the site is set up, not what its operators intend. There is no signed attestation tying the company to its wallets. If a page here ever claims otherwise, that page is wrong and this one wins.

    Report a security issueTest your own guardsRun the safety checksOpen the proof registryThe Vealth Standard