How Hush keeps you safe

Your wallets

Hush never receives the private keys of the wallets you link. To sign in or link a wallet, you sign a short message that names this site, includes a one-time code and expires after five minutes. Hush checks the signature to confirm you own the address. Signing that message is not a transaction: it can't move money and costs nothing.

Payments you send

• Hush builds the transaction, checks your balance, and runs a dry run on Solana before showing it to you, so mistakes surface as clear messages.
• You see the recipient, amount, fee and note on a review screen. Then your wallet asks you to sign. Hush can't sign on your behalf.
• Every payment is a standard Solana transaction you can inspect on Solscan.

Your built-in Hush wallet

If you don't use a wallet app, you can create a Hush wallet in one click. Like agent wallets, Hush holds its key, encrypted with AES-256-GCM, and signs a payment only after you've reviewed and confirmed it in the app. It's convenient, but it's custodial: treat it like a current account, keep larger amounts in a wallet app you control, and move money out any time.

View-only addresses

You can add any Solana address to watch its balance and history. Hush has no key for these, so they can never send. Anyone can read this public data on-chain; Hush just shows it to you.

Agent wallets

Agent wallets are different by design: so an agent can pay without you, Hush holds the agent wallet's key.

• Each agent key is generated on Hush's servers and stored encrypted with AES-256-GCM, using a master key kept separately in the hosting environment. It's only decrypted in memory at the moment of signing.
• Before signing any agent payment, Hush checks the pause switch, approved sites, max per payment and daily cap. The day's budget is reserved before sending, so parallel requests can't slip past the cap.
• Agent API keys are stored only as SHA-256 hashes, shown to you once, and can be replaced instantly.
• Withdrawals only go to wallets linked to your account.

Your account

• Passwords are hashed with scrypt and a unique salt. We can't read them.
• Sessions use signed, HttpOnly, Secure, SameSite cookies that last seven days.
• After 8 wrong passwords, logins for that email pause for 15 minutes.
• Password reset links work once and expire after one hour.
• Every action that changes something must come from the Hush site itself, which blocks cross-site attacks.

Data & privacy

What we store: your email and password hash (if you use email), linked wallet addresses, contacts, agent settings and agent payment logs, kept in private storage. We don't sell data and don't run ad trackers.

What's public: Solana is a public ledger. Your addresses, balances and transactions are visible to anyone on-chain, whether or not you use Hush. Encrypted amounts with Solana's confidential transfer standard are on our roadmap.

Services we rely on: Vercel (hosting and storage), Solana RPC providers (to read balances and send transactions, so they see the addresses involved), Jupiter (SOL price), Resend (reset emails, if enabled), and Google Fonts, jsDelivr and cdnjs (fonts and code libraries).

Known limits

• Hush is new and hasn't had an independent security audit yet.
• There's no two-factor authentication for email logins yet. Signing in with a wallet is the stronger option today.
• Agent limits are enforced by Hush before signing, not by an on-chain program.

Report a security issue

Found something? Email hush@gmail.com with "Security report" in the subject. Please give us a chance to fix it before sharing it publicly.