# Execution Client Security and Permissions Checklist

Version: 1.0
Last reviewed: 2026-07-27

Use this checklist for FRB or any other execution client. A checked item records
a review step; it does not guarantee safety.

## Release and device

- [ ] Obtain the installer from the official release page.
- [ ] Compare the filename, version, size, SHA-256 value, and signing status.
- [ ] Apply operating-system and browser security updates.
- [ ] Use a dedicated operator account with the minimum required privileges.
- [ ] Define a tested rollback and incident-contact path.

## Keys and permissions

- [ ] Document where each key is created, stored, backed up, and revoked.
- [ ] Confirm whether signing is local, remote, delegated, or custodial.
- [ ] Use a dedicated wallet with deliberately limited capital.
- [ ] Set contract, token, chain, spending, slippage, and session limits.
- [ ] Review approvals and revoke permissions that are no longer required.
- [ ] Never place a seed phrase, private key, or API secret in analytics or logs.

## Network and execution

- [ ] Record every RPC, WSS, relay, builder, or block-engine dependency.
- [ ] Verify privacy, retention, fallback, cancellation, and status behavior.
- [ ] Distinguish endpoint receipt, simulation, inclusion, and finality.
- [ ] Simulate the same transaction shape intended for live execution.
- [ ] Define stop conditions for stale state, endpoint failure, and fee changes.
- [ ] Verify final on-chain receipts independently.

## Incident readiness

- [ ] Know how to stop the client and revoke active permissions.
- [ ] Preserve logs without wallet addresses, secrets, or personal data.
- [ ] Rotate exposed credentials and move remaining assets using a clean device.
- [ ] Report suspected product vulnerabilities through the official channel.