Security model
What the website can and cannot do with your wallet, why signing lives in a separate program, and where the boundary between them sits.
The platform is built around one structural decision: the website never holds a private key and therefore cannot move anything.
This page describes what that means in practice, what it protects you from, and what it does not.
The website reads, and only reads
You give the site a public address. It reads the chain at that address and shows you what is there.
There is no field anywhere on the site that accepts a private key, a seed phrase or recovery words. Not on sign-up, not in settings, not in support. Nothing accepts them, because nothing has a use for them.
Which means a full compromise of the site — every server, every database, the account of whoever runs it — does not move a single coin. There is nothing there to steal. An attacker gets addresses that were already public and password hashes for an account that cannot sign anything.
That is the whole point. Most large crypto losses are not people losing keys; they are platforms losing keys that belonged to thousands of people at once. A platform that never holds one cannot repeat that.
What the website therefore cannot do
It cannot send your funds. It cannot sign a transaction or a message. It cannot approve a token, stake, enter a presale or interact with any contract on your behalf. It cannot recover an address, freeze it, or reverse anything done with it.
None of this is a limitation that could be lifted with better code. Every one of those actions requires a private key, and the design is that no server has one.
Where signing happens
In SWOP, on your own computer.
The key is entered there, used there, and erased when the program closes. Nothing is transmitted — SWOP's security model describes exactly what leaves the machine, which is public addresses and signed results.
The split is deliberate. Reading is safe and belongs on a server where it can run continuously and store history. Signing is dangerous and belongs on a machine you control. Putting both in one place would mean either a website that holds keys, or a desktop program that has to do work it is badly suited for.
Your account
Passwords are stored as bcrypt hashes. The stored value cannot be reversed into your password.
Sign-in attempts are rate-limited: eight failures from an address within fifteen minutes and further attempts are refused for a period. This makes guessing a password impractical without affecting anyone signing in normally.
Sessions are server-side, with the browser holding only a reference.
There is no email recovery, because there is no email address. This is the cost of an account that asks for nothing identifying. Your password is the only way in, so use a password manager.
Payments
The subscription is paid in ETH to an address generated for your account, and confirmed by reading the chain.
No card number, bank detail or payment credential exists anywhere in the system, because none is ever collected. The failure mode where a platform leaks card data is not available here.
Received funds are moved to the company wallet on a schedule. The address you paid to is not a wallet you should keep using.
What this does not protect you from
The honest half of a security page.
Your own password. Reused somewhere it leaked, it lets someone read your holdings. They still cannot move anything — the account has no signing ability — but the information is not nothing.
Your address being public. A tracked address is public by construction. Anyone who has it sees the same balances on any block explorer. If it is linked to your name anywhere, that link exists independently of this platform. Using a separate address for tracking is reasonable.
Phishing. Nobody at Siade Whales will ever ask for a private key or recovery phrase, through the site, through support, or by any other channel. Any such request is an attempt at theft regardless of what it looks like. There is no circumstance, no verification step, no account issue that requires one.
A fake SWOP. Check the SHA-256 checksum of what you download. This is the one step people skip and the one that matters most.
What you sign. SWOP decodes requests and flags dangerous ones. It cannot stop you approving something. A signature is valid because you made it.
Losing your keys. There is no recovery anywhere in this system. That is what self-custody is, and Holding your own keys covers what it actually requires of you.
Reporting a problem
Security issues in SWOP go through the repository's private reporting channel — the Security tab at github.com/siadewhales/swop, Report a vulnerability. Not a public issue.
For the website, open a support thread from your account.