What we have reviewed, what we found, and what we have not done. Including the parts that do not flatter us.
Last updated 10 September 2026.
SNIPR has not been audited by a third party. No independent security firm has reviewed this system. What follows is our own review of our own code. We think publishing it honestly is worth more than a badge, and we will say so here the day an external audit is actually done, with the firm's name on it.
What you are trusting us with
SNIPR is custodial. We create a trading wallet for you and hold its key, encrypted. That is the plain fact and the most important thing on this page. It means:
Anyone who obtained both our database and our master key could take what is in those wallets.
You can export your key or withdraw at any time. Nothing is locked in.
Keep only what you are actively trading in the bot. We would give the same advice about any custodial bot, including the ones that do not say this.
Moving to keys we cannot unilaterally use, held in a trusted execution environment, is on our roadmap. Until it ships, do not let anyone tell you this product is non-custodial, including us.
How your key is stored
Encrypted with AES-256-GCM before it reaches the database, bound to your wallet address, so a ciphertext copied onto another row will not decrypt.
The master key lives only in the environment of the running process, never in the database. A database dump on its own does not yield funds.
Plaintext key material is wiped from memory once encrypted.
It is decrypted in exactly three places: making a trade, making a withdrawal, and when you ask to export it.
How we try not to lose your money to our own bugs
Most of what goes wrong with trading bots is not a hack. It is accounting.
A transaction's signature is saved before it is broadcast, so a crash mid-send is always recoverable.
A trade is only ever marked failed when the chain says it definitively failed. If the outcome is unknown, it stays open and a reconciler resolves it from chain state. We will never tell you a trade failed while your money is in flight.
Your position and cost basis are read from the confirmed transaction itself, not from an estimate.
Only one engine may run against our database, so a restart cannot double a snipe. Your hourly caps and daily budgets are counted in the database, so a restart cannot reset them either.
A stop-loss that fails retries with rising slippage instead of quietly switching itself off.
What our review found
Reviewing our own work across several rounds, we found and fixed 20 issues we considered serious enough to record, four of them capable of losing money. Examples, in plain terms:
What was wrong
What we did
A trade that landed after a timeout was recorded as failed, while the money had actually moved
Signatures are saved before sending, and only definitive outcomes fail
A protection meant to avoid failed transactions could send a second, different one — so both could land
The same bytes are re-sent instead of a new transaction being built
Two people copy-trading each other could drain both wallets in a loop
Copy trades never mirror our own, and caps and budgets are enforced in the database
A referral payout that failed could pay one level twice
Each level is claimed separately and the amount is fixed inside the same transaction
A stop-loss set on a chain we do not yet monitor was shown as active
We now refuse to offer automatic exits where we cannot honour them
The full internal review, including severity, our threat model and the risks we are knowingly accepting, is kept with the code.
Known limits, stated plainly
Automatic exits work on Solana. Take-profit, stop-loss and trailing stops are monitored there. On other chains we hide those controls rather than show a stop that cannot fire.
Nothing outside Solana is live. Other chains are built and in testing. We will announce each one when it is real, not before.
Seven known vulnerabilities remain in third-party packages we depend on. We pinned fixed versions where they exist, which removed five. Of the rest, one is reachable in principle and the others are not on our code path. We track them.
We have not been penetration tested, and we have no bug bounty yet.
If you find something
Please tell us before you tell anyone else, and we will credit you publicly if you want that. Contact: SECURITY_EMAIL.
If any of this makes you want to keep less money in the bot, that is the correct response, and it is the same thing we would tell a friend.