Security
What This Platform Does, and Never Does
Lattice is designed so that the most sensitive things in crypto, private keys and seed phrases, never touch it.
Never submit secrets
Do not enter private keys, seed phrases, wallet recovery phrases, API secrets or any production credential anywhere on this platform. No feature requires them, and no field accepts them by design.
What the platform does
- Publishes educational research with sources and review dates.
- Runs a self-reported readiness assessment with deterministic, explainable scoring.
- Runs 13 real signature and key-encapsulation algorithms with ephemeral keys that never leave your browser.
- Provides templates, checklists and educational code examples.
What it does not do
- It does not make Solana, any wallet or any application quantum-safe.
- It does not perform a security audit, penetration test or certification.
- It does not create, import, store or transmit user private keys or seed phrases.
- It never sends blockchain transactions and never asks you to connect a wallet.
- It does not implement cryptographic algorithms itself; it uses verified libraries and labels them.
Data
What We Store
- A random, opaque session identifier in an HttpOnly cookie, used to link your assessments to your browser. The server stores only its hash.
- A display name you choose ("Builder" until you change it).
- Assessment answers: the options you selected, their scores and the generated report.
- Playground activity: algorithm names, byte sizes and timings. Never keys, signatures, ciphertexts or messages.
- If you create one, a SHA-256 hash of your workspace key. The key itself is shown to you once and never stored.
- If you share a report, a random link token you can revoke at any time.
- Messages you send through the contact form, with the reply address you give.
Labels
Real Cryptography, Named Sources
Every playground result comes from a real implementation, and every result names the library that produced it.
Real cryptography
Keys, signatures, ciphertexts and shared secrets are produced by @noble/post-quantum and @noble/curves, open-source libraries with published test vectors.
Runs where you are
Signing, verification and encapsulation run in your browser. Only the comparison benchmarks run on the Lattice server, and they report that environment.
For learning and prototyping
Pure-JavaScript implementations do not promise constant-time execution. Production systems need independently reviewed implementations.
Providers in this deployment
| Algorithm | Provider | Status |
|---|---|---|
| ed25519 | @noble/curves (ed25519) | Real cryptography |
| secp256k1 | @noble/curves (secp256k1) | Real cryptography |
| ml-dsa-44 | @noble/post-quantum (ml-dsa-44) | Real cryptography |
| ml-dsa-65 | @noble/post-quantum (ml-dsa-65) | Real cryptography |
| ml-dsa-87 | @noble/post-quantum (ml-dsa-87) | Real cryptography |
| falcon-512 | @noble/post-quantum (falcon-512, padded) | Real cryptography |
| slh-dsa-sha2-128f | @noble/post-quantum (slh-dsa-sha2-128f) | Real cryptography |
| slh-dsa-sha2-128s | @noble/post-quantum (slh-dsa-sha2-128s) | Real cryptography |
| x25519 | @noble/curves (x25519) | Real cryptography |
| ml-kem-512 | @noble/post-quantum (ml-kem-512) | Real cryptography |
| ml-kem-768 | @noble/post-quantum (ml-kem-768) | Real cryptography |
| ml-kem-1024 | @noble/post-quantum (ml-kem-1024) | Real cryptography |
| x-wing | @noble/post-quantum (ml-kem-768 + x25519) | Real cryptography |
Engineering
Platform Safeguards
Defence in depth on every request, every form and every response.
- Server-side validation of every input with Zod schemas and structured error responses.
- Same-origin enforcement for every state-changing API request.
- Per-client rate limiting on API routes.
- Security headers including a Content Security Policy, frame denial and a strict referrer policy.
- Free-text fields reject text that looks like key material: seed phrases, base58 or hex secret keys, keypair arrays, PEM keys.
- No secrets in client bundles; server configuration is read only on the server.
- Error responses never include stack traces.
Disclosure
Reporting a Security Issue
If you find a vulnerability in Lattice, report it privately through the security report form with steps to reproduce, and allow reasonable time for a fix before any public disclosure. Never include real key material in a report.