§ Developers

Open source. Auditable.

The cryptographic core of American Reserve is published open source. Read the code, run the tests, build on the same primitives, or verify our security claims yourself.

Security model →

Monorepo packages

@american-reserve/wallet-core

BIP-39 mnemonic generation, BIP-32/44/84 HD derivation, AES-256-GCM encryption, and address utilities for Bitcoin, Ethereum, and BNB Smart Chain.

TypeScriptZero I/OBrowser + Node

@american-reserve/blockchain

Chain-agnostic transaction builders, fee estimators, and balance fetchers. Connects to public RPC nodes — no proprietary API required.

TypeScriptethers.jsbitcoin-js

@american-reserve/identity

Firestore-backed user identity layer, legal document management, and FAQ storage. Used by the web and admin interfaces.

TypeScriptFirebaseWeb only

@american-reserve/tokens

ERC-20 / BEP-20 token registry, custom token persistence, and price feed integration. Extends the default asset list without modifying wallet-core.

TypeScriptERC-20BEP-20

Design principles

No server keys

wallet-core contains zero network calls. All private key material stays in the calling environment. This is enforced by the check-no-io.sh CI gate.

Deterministic builds

The production binary is built from the published source with a locked dependency tree. You can reproduce the build and compare checksums independently.

Auditable derivation

HD derivation paths follow published BIP standards. Any BIP-39 compatible tool can derive the same addresses from the same seed — no proprietary derivation logic.

Typed and tested

Every package ships with TypeScript declarations and a Vitest test suite. The CI pipeline enforces typecheck, lint, and test passage before any merge.

CI pipeline — every pull request

Format check

Prettier — enforces consistent code style across the monorepo

Lint

ESLint — catches common errors and enforces import hygiene

Typecheck

tsc --noEmit — full TypeScript type validation across all packages

Tests

Vitest — unit tests for wallet-core, blockchain, and web lib

Build

Next.js production build + Expo export

Dependency audit

pnpm audit — blocks high/critical severity CVEs

Wallet-core purity

check-no-io.sh — asserts zero network or fs calls in wallet-core

Cert-pin guard

check-cert-pins.sh — flags missing certificate pin placeholders

Quick start

# Install dependencies

pnpm install

# Run all tests

pnpm test

# Start the web app

pnpm --filter web dev

Found a vulnerability?

Please disclose responsibly via our security contact before opening a public issue.

Security contact