RP1’s public security model is layered. The chain enforces protocol and module invariants; applications, wallets, relayers, operators, and institutions still own their local trust boundaries.
Key boundaries
- Wallets own mnemonic, private-key, proving-key, and viewing-key custody.
- Validators own consensus signing material and must not share it with RPC or application users.
- Bridge relayers transport evidence and collect threshold shares; they do not replace on-chain proof checks.
- Institutional applications own KYC, policy, off-chain reserve evidence, and operator authentication.
- Agents should receive scoped permissions and budgets, not unrestricted account custody.
API hardening
Use TLS and authenticated transport where the deployment requires it. Apply request body and batch limits, validate addresses and integer strings, paginate logs and historical queries, and treat WebSocket events as hints that must be reconciled by hash.
Pause and recovery
Pause controls should increase safety without trapping already-reserved claims or blocking redemption when the module explicitly keeps it open. A failure state must be observable and retryable; a client should not silently retry a payment, bridge, or redemption with a new identity.
Reporting
Use the public disclosure policy for documentation. Report suspected vulnerabilities through the project’s approved security channel rather than publishing exploit details in an issue or page.