Security: what protects your data, and how to check it
Updated on 25 October 2026
This page describes the site's protections as they are actually in place, and gives for each one a way to check it yourself, without taking our word for it: from your browser's developer tools (F12 or "Inspect", the tabs Network, Application / Storage) or from your wallet app. Anything that cannot be checked from outside is marked as such. The page is updated whenever the site changes; the current version is shown at the bottom of every page. The raw results of the technical audit (accessibility, performance, headers, libraries, code) are published under Audit.
1. Your wallet: read only, no signature
- The site asks your wallet for only one thing: your public address (the standard connection request,
eth_requestAccounts/connect). It never asks for a signature, a transaction, a token approval or a recovery phrase. - An address pasted by hand is enough: no account, no extension.
- The site has no private key, so there is no way to move funds, neither for us nor for an attacker who took control of the server.
Check: when you connect, your wallet shows exactly what it is being asked for. You should see " bilandefi.fr wants to see your address " (or similar), and nothing else. If you are offered a signature, a transaction or an approval, decline: it is not bilandefi.fr. You can revoke the permission at any time in your wallet settings ("connected sites").
2. A single third-party script: audience measurement, without cookies
- Every page is served with a content security policy (CSP) that only allows the site's own scripts and images, plus the Umami audience measurement script:
script-src 'self' https://cloud.umami.is. An injected script, an ad or an advertising tracker cannot run. - The only scripts are the site's own: reading the address from the wallet, detecting the network of a pasted address, and (only if you click WalletConnect) the WalletConnect SDK, served by our server (pinned version), never by a third party.
- Audience measurement : the Umami script (
cloud.umami.is, no cookies) counts page views. A filter on the site runs before each send: the page path is sent without its parameters (the link to an overview is never sent), and the title of a page that contains an address becomes "Bilan". It is not loaded on password pages or on the admin pages. - The report itself (the overview page) is an HTML page with no calculation script: everything is calculated on the server, and the tabs and hover effects are CSS.
Check: open the Network tab of the developer tools, then reload a page: all requests go to bilandefi.fr, except audience measurement (cloud.umami.is,
gateway.umami.is). Other exceptions, only if you trigger them:
accounts.google.com when you choose "Continue with Google", the WalletConnect relay (*.walletconnect.com / *.walletconnect.org, *.reown.com) when you click WalletConnect. The Content-Security-Policy header of each response lists what is allowed.
3. Security headers, on every response
| Header | Value | What it prevents |
|---|---|---|
Content-Security-Policy | default-src 'self'; script-src 'self' https://cloud.umami.is; img-src 'self' data:; connect-src 'self' (et Umami); frame-ancestors 'none'; base-uri 'none'; form-action 'self' https://checkout.stripe.com https://billing.stripe.com | Scripts and resources from elsewhere, forms redirected to another site (only Stripe payment pages are allowed) |
Strict-Transport-Security | max-age=31536000; includeSubDomains | Any unencrypted (HTTP) connection once the site has been visited over HTTPS |
X-Frame-Options | DENY | Displaying the site inside a frame on another site (clickjacking) |
X-Content-Type-Options | nosniff | A file being interpreted as a script |
Referrer-Policy | same-origin | The page address (and what it contains) leaking to another site |
Cache-Control | private, no-store | An overview being kept in a shared cache (proxy, host) |
Permissions-Policy | browsing-topics=(), interest-cohort=() | Ad targeting in the browser |
Check: open the Networktab, click the page request, then
Response headers. Or, in a terminal: curl -sI https://bilandefi.fr/faq.
4. What leaves your browser
- To the site : the public address to analyse, your answers to the points to settle, and what you type into a form. Nothing else: no device identifier, no audience measurement.
- In links : the address no longer appears in plain text; it travels encrypted
(
?a=…, authenticated AES-SIV), unreadable to the host and its logs. Your answers travel encrypted too (?r=…, AES-GCM, different for each link). - Answers to the points to settle : they stay in your browser; the server only keeps anonymous counters (day, protocol, network, answer), with no address.
Check: open an overview, then look at the address bar: ?a= followed by a token, not your address. In the Networktab, requests carry no data you have not entered yourself.
5. Cookies
| Cookie | Purpose | Duration | Attributes |
|---|---|---|---|
pat_session | Your session (only if you have an account) | 12 h | HttpOnly, Secure, SameSite=Lax, signed: a modified cookie is ignored |
pat_session_oauth | The round trip to Google (state, PKCE) | 30 min | HttpOnly, Secure, SameSite=Lax |
bd_niveau | Your level (beginner, intermediate, expert) | 1 year | HttpOnly, Secure, SameSite=Lax; no identifier |
bd_portefeuille | The crypto wallet you chose to create (Trust Wallet, MetaMask or Rabby), to tailor the "step by step" list | 1 year | HttpOnly, Secure, SameSite=Lax; no identifier |
bd_ecran | Your screen size (width × height, density), for audience measurement | 6 months | Secure, SameSite=Lax; set by the page, no identifier, no third party |
bd_alu | Alerts already read in the Alerts tab (short fingerprints, no address) | 1 year | HttpOnly, Secure, SameSite=Lax; no identifier |
Check: developer tools, the Application (Chrome) or Storage (Firefox) tab, then Cookies. There are no others, and none belongs to a third party.
6. Accounts and passwords
- Passwords hashed with scrypt (OWASP parameters, a salt per password): we cannot read them.
- Confirmation link valid for 24 h, reset link valid for 1 h; changing your password invalidates all links in circulation.
- Temporary lockout after repeated failures; an email address that is already registered is never revealed to the visitor (the account holder is notified instead).
- Google sign-in through OpenID Connect with PKCE and a nonce; the site only sees the email address, the name and the profile picture.
- The site only accepts an exchange API key that is read only (a key that allows withdrawals is rejected), stored encrypted ; keys are never displayed again.
- An account area only sees its own data: every database read is filtered by the account area's identifier.
7. What the server keeps, and in what form
- The report is not stored : calculated, displayed, kept in memory for at most 45 minutes, never on disk.
- The blockchain data cache is stored under a secret-key fingerprint (HMAC-SHA256) of the address (the address cannot be recovered from a file name, and there is no way to tell whether an address has been analysed), and its content is encrypted (AES-GCM). The key comes from the host's environment, never from disk.
- The database runs on the same server, in Frankfurt (DigitalOcean), with no port open to the Internet; it is backed up every night. The site refuses to start with a default session secret.
- The full list (item by item, retention period, who can access it, how to delete it) is on What we do with your data. "Delete my data", from your account area, erases everything immediately.
What you cannot check from outside : the encryption of the cache and the database, the retention time in memory. These are the publisher's commitments, described here as they are coded; they are binding under the GDPR (RGPD).
8. Against scraping and abuse
- Rate limits per visitor (and per account), tighter on overview calculations; temporary suspension of scripts that sweep the site. The site's logos and files do not count towards them: viewing a page is never penalised.
- Automated tools that identify themselves as such cannot reach the pages that are costly to serve.
- No public API returns data in bulk.
9. Security review and reporting
- Last internal review: 29 2026 September (v0.6.8): authentication, isolation of account areas, HTML escaping, headers, WalletConnect relay, account deletion, dependencies (
pip-audit: no known vulnerabilities). Fixes made on this occasion: escaping of quotes in HTML attributes (no execution possible thanks to the CSP), exact scope of the WalletConnect relay (pinned version), HSTS extended to subdomains, deletion of watched positions and days of presence along with the account, refusal of the default secret. - Found a vulnerability? Write to contact@bilandefi.fr (see also /.well-known/security.txt). We reply within 72 h and fix the issue before any disclosure; no legal action against good-faith research that does not access other people's data.