Security

Scamiro is built for a high-risk domain: crypto scams, wallet drainers, and deceptive smart contracts. Security is central to our product — both what we detect for users and how we operate our own systems.

We implement layered controls including:

• TLS encryption for all traffic between your browser and our APIs.
• Segmented production environments with least-privilege access for engineers.
• Automated dependency scanning and security patching for critical vulnerabilities.
• Encrypted backups and monitored uptime with incident response procedures.

Account sign-in supports industry-standard OAuth providers and secure session management. Administrative consoles require separate credentials, MFA where available, and are access-logged.

API tokens and session cookies are stored using secure, httpOnly patterns where applicable. We never ask for your wallet seed phrase or private keys.

Scan submissions and user profiles are stored in access-controlled databases. Sensitive configuration and secrets are managed via environment isolation and secret managers, not committed to source control.

We minimize data collection to what is necessary for the feature you use and purge or anonymize data according to our retention policy.

Our detection pipeline combines on-chain heuristics, contract bytecode analysis, URL reputation, and machine-learning signals. Models are continuously evaluated against emerging scam patterns reported by the community and partners.

Even with strong platform security, you remain the final gatekeeper of your assets:

• Always verify contract addresses on multiple sources before signing transactions.
• Use hardware wallets for significant holdings and revoke unnecessary token approvals.
• Treat “safe” scan results as one input — not a substitute for due diligence.
• Report suspicious projects through our feedback channels to improve collective protection.

If you discover a vulnerability in Scamiro, please report it responsibly to security@scamiro.com. We ask that you allow reasonable time for remediation before public disclosure and avoid accessing or modifying other users’ data.

We appreciate researchers who help keep the ecosystem safer and may acknowledge valid reports at our discretion.

In the event of a confirmed security incident affecting user data, we will investigate promptly, mitigate impact, notify affected users as required by law, and document lessons learned to prevent recurrence.