> ## Documentation Index > Fetch the complete documentation index at: https://docs.yield.xyz/llms.txt > Use this file to discover all available pages before exploring further. # Security Notice > Yield.xyz security posture, incident history, and active security notices, including API key exposure in widget and frontend deployments. ## Security & Incident History **Last Updated: October 2026** Yield.xyz operates with security as a first-class design principle. We hold a **SOC 2 Type II** report, available on the [Trust Center](https://trust.yield.xyz), and follow a layered, defense-in-depth security model across infrastructure, transactions, and protocol integrations. *** ## Zero Security Breaches > **No Incidents to Date** > > Yield.xyz has had **no security breaches, hacks, or loss of client funds** since inception. *** ## Safeguards Against Malicious Transactions Yield.xyz follows a **zero-trust transaction model**. All transactions returned by the API are unsigned and must be explicitly reviewed and signed by the client's custody or signing infrastructure. We provide **Yield.xyz Shield**, a transaction validation layer that allows clients to programmatically verify: * Target contract addresses * Function selectors and calldata * Token approvals and spend limits Shield is specifically designed to prevent man-in-the-middle and payload-tampering attacks, including attack classes similar to recent industry incidents (e.g., Kiln / SwissBorg vulnerabilities), where malicious calldata or altered approvals could be injected between transaction construction and signing. By validating intent and call data before custody signing, Shield ensures only expected, deterministic transactions are ever approved. When combined with institutional custody systems (e.g., Fireblocks), this provides strong defense-in-depth protection across the full transaction lifecycle. > **[Learn More About Shield](/documentation/security/shield.md)** > > Transaction validation library documentation *** ## Protection Against Compromised Protocols Yield.xyz continuously monitors protocol health, integration behavior, and validator performance. For validator-based staking, we maintain SLAs with our preferred validator partners covering uptime and operational reliability. ### Key Safeguards * **Non-custodial architecture**: Yield.xyz does not autonomously execute transactions or move client funds. All capital movements require explicit client-side review and signing through the client's custody or signing infrastructure (e.g., MPC, HSM, custodians). * **Access controls**: Access to Yield.xyz APIs and dashboards is restricted to authenticated and authorized users, with permissions scoped per client and per environment. * **Change management**: New protocol and yield integrations are introduced through a documented review and change-management process prior to production deployment. ### If a Protocol Becomes Unsafe If a protocol or yield becomes unsafe, paused, or compromised: 1. The yield is marked as **maintenance / deprecated / disabled** via metadata 2. New deposits are **blocked** where appropriate 3. Clients are **proactively notified** through designated communication channels If a protocol risk or security issue is identified after deployment, Yield.xyz follows a documented incident response and escalation process, including containment actions and proactive client communication. Affected yields remain accessible for position monitoring and safe exits, and are only re-enabled once the protocol is deemed safe to operate again. ### Third-Party Monitoring As an additional fail-safe mechanism, clients may integrate third-party on-chain risk and monitoring tools such as **Hypernative**, enabling independent detection of DeFi protocol incidents or abnormal behavior alongside Yield.xyz controls for layered risk management. *** ## Fines and Penalties Yield.xyz has not incurred any fines or penalties related to security incidents. *** ## Volume and Scale Yield.xyz operates at production scale across multiple institutional and enterprise clients: | Metric | Value | | - | - | | **API requests** | 500M+ per month | | **Clients** | 200+ live clients, reaching 300M+ end users | | **Institutions** | 1,000+ served through the custody platforms we power | More granular metrics, such as per-client volumes and request breakdowns, can be shared as ranges or exact figures under NDA, depending on disclosure requirements. *** ## External Audits and Validation Security is reinforced through a combination of internal controls, external audits, and regulatory engagement: ### Regulatory Engagement Yield.xyz views proactive coordination with regulators as a key part of its compliance approach and has engaged in discussions aligned with applicable requirements of the French Monetary Authority (Autorité des marchés financiers, AMF) in connection with an integration for a French neobank. ### Third-Party Security Audits > **Trail of Bits** > > Security assessment, Q3 2024 > **Zellic** > > Smart contract audits, Q1 2025 and Q3 2024 **Audit reports include:** * [Zellic: Smart Contract Security Assessment (OAV), Q1 2025](https://github.com/Zellic/publications/blob/master/StakeKit%20-%20Zellic%20Audit%20Report.pdf) * [Zellic: Smart Contract Security Assessment (Fee Wrapper), Q3 2024](https://github.com/Zellic/publications/blob/master/StakeKit%20FeeWrapper%20-%20Zellic%20Audit%20Report.pdf) ### Ongoing Security Practices * Penetration testing and vulnerability assessments * Remediation cycles * Engagement with in-house white-hat security engineers * External security researchers Audit summaries, penetration test reports, and supporting documentation can be shared under NDA as part of due diligence. *** ## Trust Center For additional transparency, security posture, and trust artifacts, please refer to our Trust Center: > **[Trust Center](https://trust.yield.xyz)** > > [https://trust.yield.xyz](https://trust.yield.xyz) *** ## Security Notices This section lists active security notices for Yield.xyz deployments. It is part of our ongoing commitment to transparency and security; check back regularly for updates and additional guidance on protecting your deployments. ### API Key Exposure (Low Risk) In widget deployments and native frontend integrations, the Yield.xyz API key is accessible to anyone interacting with the widget or with a frontend that calls the Yield.xyz API directly. The risks below apply to these deployments, along with the mitigation strategies that follow. #### Risk Overview | Risk | Description | Impact | | - | - | - | | **Unauthorized API usage** | The API key can be extracted by anyone with access to the widget, allowing them to use the API without authorization. | Financial costs may be incurred by the key owner due to unauthorized usage. However, any rewards or benefits from API usage would still be directed to the key owner. | | **API rate limit exhaustion** | An attacker could monitor the rate limits associated with the API key and intentionally send requests to exhaust these limits. | Legitimate users may experience service disruptions if the API rate limit (e.g., 500 requests per minute) is exceeded. | | **Phishing vector** | The API key could be used by an attacker to craft requests that trick users into performing unintended actions, such as confirming a malicious transaction. | Direct financial exploitation is unlikely, but this scenario presents a potential phishing risk. | #### Mitigation Strategies * **Proxy server**: Set up a proxy server that securely stores the API key and authorizes requests based on additional authentication mechanisms. This can limit unauthorized access and control the rate of requests. * **Rate limit monitoring**: Yield.xyz actively monitors the usage of your API key to detect and respond to any unusual activity, such as spikes in request volume that could indicate an attack. * **Certificate pinning**: Contact Yield.xyz for assistance in implementing certificate pinning to enhance security. * **Origin validation**: Yield.xyz can implement origin validation to restrict the use of the API key to its intended deployment environment. Note that this measure can be bypassed if requests are made from non-browser environments. Contact Yield.xyz for assistance. While the exposure of the API key presents some risks, these can be managed through careful assessment and the implementation of appropriate security measures. Review these risks and strategies to ensure that your widget deployments remain secure and functional. *** ## Reporting Security Issues If you discover a security vulnerability, please report it responsibly. ### Contact **Email:** [security@yield.xyz](mailto:security@yield.xyz) ### What to Include * Detailed description of the vulnerability * Steps to reproduce * Potential impact assessment * Any suggested mitigations ### Our Commitment * We will acknowledge receipt within **24 hours** * We will provide an initial assessment within **72 hours** * We will keep you informed of remediation progress * We recognize responsible disclosures (with permission) > [!WARNING] > > Please do not publicly disclose vulnerabilities before we have had an opportunity to investigate and remediate. *** ## Contact **Security Team:** [security@yield.xyz](mailto:security@yield.xyz) **General Support:** [support@yield.xyz](mailto:support@yield.xyz) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.