Read-only by design. Accountable by default.
RIVEXIS observes public wallet information and models user-selected actions. Assets remain under your control. Account identity and historical records stay on the existing infrastructure.
Explore the workspace ↗Wallet permissions
A verified account is required for live address inspection. Optional browser-wallet access requests an address only. No private keys, seed phrases or signing permissions are requested.
Account protection
Existing Supabase authentication, HttpOnly secure sessions, CSRF controls and server-side ownership checks are retained. Privileged keys remain on the server.
Data and retention
Financial state is not automatically stored in the browser. Account reports are explicitly saved, owner-scoped and capped at 20. Public RPC providers see queried addresses; exported receipts contain public financial information.
Known security findings
The current Supabase advisor reports pg_net in the public schema and disabled leaked-password protection. All public tables have RLS enabled. Legacy service-only tables intentionally have no client policies. Dependency findings and validation are tracked in the repository’s dated release evidence. These findings are retained in release evidence.