Security

Permissions

• storage — to keep your memory on your device.
• Runs only on pump.fun and axiom.trade. It is not loaded on any other site.
• May contact only api.dexscreener.com and lite-api.jup.ag, for market caps.
• Those four sites and two APIs are the complete host list. In Firefox you grant them yourself, from the toolbar popup.

No tabs permission, no clipboard, no history, no downloads, no "all sites".

No wallet, ever

There is no wallet code in DJVU. It cannot connect, sign, or send. It does not know what a private key is. If a version of DJVU ever asks for wallet access, it is not ours.

Read only, and only the address

On a coin page the extension reads the address from the URL and, on Axiom, from the page's own explorer links. It does not read forms, inputs, or anything you type on the site. Its UI lives in a closed shadow root: the page cannot style or script it, and it does not touch the page's DOM beyond adding one host element.

One place talks to the network

All requests are made by the background worker, from one file. Content scripts never fetch. The extension's own pages are locked down with a content security policy that allows no remote scripts.

Unlimited keys

Keys are Ed25519-signed and verified offline inside the extension. The public key is built in; the private key never ships. A key cannot be forged without it, and verifying one sends nothing anywhere.

Reporting

Found something? hello@usedjvu.xyz. Please don't post exploits publicly before we've had a chance to fix them.