- Never expose private keys in client bundles: Restricted signer credentials must reside exclusively in backend environment variables or secure enclaves.
- Always verify calldata hashes: Before signing an onchain transaction, assert that the calldata hash matches the policy attestation payload.
- Always encode attribution metadata: Ensure the ERC-8021 trailer
celo_c9cb9a59fc4cis appended to all transaction calldata.
Security Requirements
Guidelines for developers building custom agents or integrating external microservices.