Security

Apogee provides software, data and developer infrastructure. Blockchain and market data can be incomplete, delayed or inaccurate. AI-generated output may contain errors. Nothing on the platform should be interpreted as financial, legal or investment advice.

Authentication and authorization

MCP is public (auth none). Authorization for value-moving actions is the user’s wallet confirmation, not the LLM. Server-side, dispatchTool does not check a user id.

API keys and secrets

• Do not put NVIDIA_* or SUPABASE_SERVICE_ROLE_KEY in client bundles.
• The Supabase anon key in the frontend is a public anon credential for limited reads.
• Never paste seed phrases into Orbit, MCP, or docs.

Rate limiting

180 req / 60 seconds / IP / process on MCP POST, REST tools, and /api/agent.

Input and output

Addresses must match 0x + 40 hex. Tool outputs are untrusted JSON from chain/providers — render as data, not as HTML. Do not execute model-generated transactions without a wallet UI.

Prompt injection and tool abuse

• Allow-list tools in your agent. High-impact: prepare_pons_launch, prepare_pons_buy.
• Require explicit user confirmation before showing an unsigned tx for signature.
• Do not let a webpage instruct the model to ignore safety rules.
• Validate arguments server-side even if the model produced them.
• Log suspicious bursts; 429 is not a complete abuse program.
• Never rely solely on the LLM to decide whether an action is safe.

SSRF and request forgery

Tools query fixed providers and user-supplied 0x addresses/tickers, not arbitrary URLs. Do not add a generic fetch tool that takes a URL from the model.

Logging and audit

apogee_usage may store tool, truncated query, ok, timestamp via service role. RLS: no public policies. Do not log unsigned tx payloads to public channels.

Supabase RLS

Usage and scan tables are written with the service role. There is no end-user auth table. If you fork the schema, keep RLS enabled and never expose service role to the browser.

Financial vs data

• DATA: RPC, Dex, Gecko, RHJ, explorer.
• ANALYTICS: scan scores, premiums, mark-to-market.
• OPINION / AI: Orbit text. May be wrong.
• ACTION: only after the user signs. Apogee does not broadcast unsigned payloads.

Report a security issue

A security issue is unauthorized access, injection, secret leakage, or a way to make Apogee broadcast or drain funds without user signature. Include product area, impact, and steps that do not include a public exploit dump.

There is no dedicated security email in this repository. Use GitHub on https://github.com/apogeemcp/- (private vulnerability report if the repo enables it). Do not post exploit PoCs in Telegram, X, or public issues. Public chat is not a disclosure channel.

Responsible disclosure: give maintainers time to patch before publishing. We do not currently publish a paid bug bounty in this codebase.