> For the complete documentation index, see [llms.txt](https://docs.bloxchain.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bloxchain.app/security/security.md).

# Security overview

How Bloxchain keeps policy on chain, what has been audited, where the limits are, and how to report a problem.

## The one-paragraph version

A Bloxchain smart account enforces its own rules. Requests wait, collect approvals and execute according to roles, gates and allowlists stored in the contract. The Bloxchain Platform orchestrates those steps in a browser; the SDK does the same from code; neither can override a denial on chain. [Integration surfaces](/developers/integration-surfaces.md) compares what each client can and cannot do. The Protocol core is audited by Nethermind (NM\_0828), core framework scope. Custom extensions and your own configuration are not covered by that audit. Official deployments are live on the 15 supported networks, in the Platform and in the Protocol. Bloxchain never holds a key.

## Pages in this section

| Page                                                             | Read it for                                                                    |
| ---------------------------------------------------------------- | ------------------------------------------------------------------------------ |
| [Security model](/security/security-model.md)                    | Assumptions, trust boundaries, threat model, what is out of scope              |
| [Audit status](/security/audit-status.md)                        | The Nethermind audit, its scope, and what each surface's status means for you  |
| [Known limitations](/security/audit-status/known-limitations.md) | Honest boundaries of the Protocol, the Platform and this documentation         |
| [Security best practices](/security/security-best-practices.md)  | Operator practices: keys, time lock, allowlists, backups, signed files, drills |
| [Report a vulnerability](/security/report-vulnerabilities.md)    | Private disclosure contact, what to include, bounty scope                      |
| [Disclaimers](/security/audit-status/security-disclaimers.md)    | Non-custodial statement, data handling, legal notices                          |

## Reading order for a security review

If you are assessing Bloxchain before deploying or integrating, read in this order.

1. [How governed operations work](/introduction/how-it-works.md): the lifecycle, execution paths, roles, gates and allowlists as users see them.
2. [Security model](/security/security-model.md): the assumptions the design rests on and the boundaries between what is trusted and what is not.
3. [Audit status](/security/audit-status.md) and [Known limitations](/security/audit-status/known-limitations.md): what has been reviewed, and what has not.
4. Protocol internals, synced from the repository: [State machine engine](/protocol-reference/bloxchain-architecture/state-machine-engine.md), [Meta-transactions](/protocol-reference/api-reference/meta-transactions.md), [Core contract graph](/protocol-reference/bloxchain-architecture/core-contract-graph.md), [Contract reference](/protocol-reference/api-reference/contract-reference.md), [Protocol best practices](/protocol-reference/getting-started/best-practices.md).
5. The code itself, at the pinned commit: [Bloxchain-Protocol](https://github.com/PracticalParticle/Bloxchain-Protocol/tree/99beac2d6e6d7567c23b25cecaf6f4053f31c987). Run `npm run test:foundry` on the revision you review.
6. Before any real value: [Production readiness](/developers/deployment/production-readiness.md) and [Security best practices](/security/security-best-practices.md).

Two adjacent pages belong in the same review: [Design roles and permissions](/guides/roles-and-permissions.md) for the role model an assessor will want to see, and [Recovery and incidents](/platform-guide/recovery.md) for the response plan behind a lost owner key or a compromised signer.

Findings go to [Report a vulnerability](/security/report-vulnerabilities.md), not to public issues.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.bloxchain.app/security/security.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.