Security & Transparency
Release reviewed: August 13, 2026
Tronoxa publishes the wallet security core used for TRON and BSC/BEP-20 handling so developers, users, and reviewers can inspect the implementation and verify the official release artifacts.
Self-custody security boundary
Recovery phrases, private keys, the app PIN, and biometric data remain on the user's device. Transaction signing takes place on the device. Tronoxa cannot recover a lost recovery phrase or private key, sign transactions for a user, freeze a wallet, or move user assets.
Published source scope
The public repository contains the wallet security implementation for TRON and BSC/BEP-20, along with source-matching evidence and hashes. It is licensed under MPL-2.0.
Verified release
The official security-core release is v1.0.0, built from source commit:
65f0478e3e073ffde516a3433d70d4409dbc5c95
The GitHub release includes reproducible source packages, the published npm package, the BSC public snapshot, and SHA256SUMS.
Build provenance
GitHub Build Provenance attestations bind the release artifacts to the repository workflow and source commit. Review the attestations and the completed release workflow before relying on an artifact.
Automated security checks
The repository uses automated validation that includes CodeQL analysis, MobSFscan, secret-pattern scanning, dependency checks, tests, and source-matching verification. These checks provide repeatable evidence; they are not a guarantee that the software has no vulnerabilities and are not presented as an independent third-party audit.
Protected change process
The public security repository's default branch is protected against deletion and force pushes. Changes must be submitted through a pull request and pass the required validation and CodeQL checks before merging.
Responsible disclosure
Report a suspected vulnerability privately to office@tronoxa.com. Include a clear description, affected component, reproduction steps, and impact. Never send a recovery phrase, private key, app PIN, OTP, or other wallet secret.
Machine-readable disclosure information is available at /.well-known/security.txt.
Open source, reproducible artifacts, provenance, and automated analysis improve verifiability but do not prove the absence of vulnerabilities. This publication covers the security core described above; it does not represent the entire mobile application, user interface, or backend as open source.