---
title: Security & custody
description: Is OpenSwap safe? The CLI never holds funds or keys — you pay a deposit address from your own wallet. Here is the full security model.
order: 6
version: 0.1.0
---

# Security & custody

The short version: **OpenSwap never holds your money and never sees your
keys.** It finds you a route and gives you a deposit address; your own
wallet does the paying. There's no seed phrase to enter, no browser
extension, and no account — which means there's nothing here to steal.

## How a swap actually works

When you confirm a swap, the route provider creates a **deposit address** —
a normal blockchain address that belongs to the swap. You pay it from any
wallet you already trust, the provider does the crosschain exchange, and
funds arrive at your destination address. The CLI's job is to compare
routes, validate everything, and keep the receipt. It's a guide, not a
custodian.

The one exception is explicitly opt-in: the [bot signer](https://leokit.dev/cli/docs/bots)
for automated trading, which is never part of the human flow.

## What protects you during a swap

- Destination and refund addresses are validated for the right chain, and
  known placeholder addresses are rejected outright.
- The final quote is re-created bound to *your* destination before you
  review it, and confirming means typing `SWAP` — not just hitting Enter.
- Amounts are recomputed with exact integer math, and the QR code is only
  shown if it agrees perfectly with the validated address and amount.
- Routes that need extra metadata a plain address can't carry are refused on
  the QR path rather than risking a mis-send.
- Your receipt is saved *before* payment instructions appear, so a crash or
  closed laptop can't lose a swap.
- If an outcome is ever unknown, the error says `funds_may_have_moved`
  honestly and nothing is blindly retried.

## How API keys are handled

Your key is looked up in this order: the `OPENSWAP_API_KEY` environment
variable → the operating system's keychain (via `openswap auth login`) → the
built-in community key. Keys are typed in privately, never accepted as
command-line flags, never written to files or receipts, and never sent
anywhere except the official API.

The community key being public is intentional: it can fetch quotes and
prepare swaps, and that's all — it cannot move funds and cannot read
anything private.

## The optional signing wallet

If you set one up, `openswap wallet setup` recommends **creating a fresh
dedicated wallet** rather than importing your main one. It's generated
locally, encrypted on disk, and asks for its passphrase at every signing.
Keep only active trading balances on it.

## Privacy

There is **no telemetry**. Receipts and logs stay on your machine with
restrictive permissions and contain no credentials. The one thing that ever
leaves your machine voluntarily is `openswap feedback` — and it shows you the
exact, redacted diagnostics and asks for consent before sending.

## Found a security problem?

Please report it privately — see the
[security policy](https://github.com/steemleo/OpenSwap/blob/main/SECURITY.md)
for the disclosure process. Don't open a public issue for an exploitable
finding, and don't send it through `openswap feedback` (that posts to a team
chat channel, which isn't confidential).