Norekt protectaurus

Frontend security for web3 · L1 shipped

Your contracts are audited. Your frontend still signs the checks.

Norekt watches the path users trust: packages, secrets, dangerous approvals on every PR — then optional pre-sign intent and deploy integrity for design partners. No code execution. Min GitHub permissions.

Install on GitHub See product layers

L1 PR Check shipped · L2 pre-sign dogfood · L3 CDN/DNS pilot · shadow by default

Checks · PR

On the PR

Green CI. Still rekt. Norekt is the missing Check.

Same frontend change — without a security Check vs with Norekt on Checks and Files.

Without Norekt Before

PR · Checks CI only

build · passed

lint · passed

No security Check. Key and token land in main if review is rushed.

With Norekt After

PR · Checks · Files Norekt

Norekt · 2 enforced findings

smoke.js:3 · W3-SEC-001 Possible Ethereum private key — rotate and remove.
smoke.js:2 · W3-SEC-002 Possible CI token (ghp_*) — rotate and remove.

Product

Three layers. One honest status line.

Same story everywhere: ship L1 on PRs, dogfood L2 before the wallet, pilot L3 after deploy. Full product page.

L1 · PR Check

Secrets, deps, SRI, unlimited approve patterns. Hosted App or Action.

Shipped

L2 · Pre-sign

Partner SDK: danger shapes + UI≠payload sheet before the wallet opens.

Dogfood

L3 · Deploy

CDN hash + DNS vs trusted baseline. Operator-owned, fail-closed.

Pilot

L4 · Signing policy

Multisig / Safe risk and simulation gates — enterprise later.

Roadmap

Layer 1 · day one

Three classes that show up on real frontend PRs.

The install path today. Pre-sign and CDN layers on Product.

W3-SEC-*

Secrets & keys

Private keys, ghp_* tokens, high-confidence secret shapes — path and line only, never the value.

Often enforce

W3-DEP-*

Protected packages

Unpinned ranges on packages you care about — wagmi, viem, ethers, Safe SDKs — when they change in the PR.

Review signal

W3-W3-*

Dangerous web3 patterns

Unlimited approve (incl. object form), eth_sign, localStorage → transaction heuristics.

Shadow-friendly

Layer 2 · dogfood

Before the wallet opens.

Partner installs @norekt/sdk in their dApp. Danger shapes and UI≠payload get a pre-sign sheet — not a map of all DeFi, not GitHub write.

01
Confirm in dApp User hits the trusted button
02
SDK intercepts Wallet request → verify()
03
Pre-sign sheet Warn or soft-block
04
Wallet Only if they continue
  • DangerUnlimited approve, legacy personal_sign
  • MismatchUI declared intent vs calldata (ATK-SIGN-001)
  • HonestIncomplete coverage never claims “safe”

Opt-in package the partner ships — same boundary as analytics. CDN takeover still needs L3.

L2 details Trust model
Norekt sign check warn

Review carefully. Unlimited ERC-20 approve — even if the button said “enable trading.”

W3-RT-001 · ATK-SIGN-001
unlimited ERC-20 approve
Cancel Sign anyway

Get it on a PR

Three steps. About five minutes.

  1. Install the App

    Pick org and frontend repo. Contents R · PRs R · Checks write.

  2. Add .web3shield.yml on main

    Start with mode: shadow. Policy from base only.

  3. Open a smoke PR

    Look for Checks → Norekt. Files for annotations.

Install on GitHub Full guide + config builder

Trust model and permissions: Security · layers: Product