> ## Documentation Index
> Fetch the complete documentation index at: https://docs.metengine.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Audit

> Independent security audit results for the MetEngine Chrome Extension

Your keys stay yours. The extension can't move your funds, can't sign transactions, and can't access your passwords. An independent security engineer verified all of this.

## Audit Results

[Manish Bhattacharya](https://manishbhattacharya.com/), a Staff Security Engineer with 9+ years securing FinTech and crypto startups, reviewed the full extension codebase. He's an 18x Google Vulnerability Research Grant recipient, recognized by Google, Apple, Microsoft, Coinbase, and Stripe.

|                               |                                            |
| ----------------------------- | ------------------------------------------ |
| **Critical issues found**     | 0                                          |
| **Total issues found**        | 5 (2 high, 3 medium)                       |
| **Issues fixed and verified** | 5 of 5                                     |
| **Architecture**              | Chrome Manifest V3 (latest security model) |

Every finding was fixed by the MetEngine team and independently verified by the auditor before the report was finalized.

## What Was Reviewed

The audit covered the full extension surface: background service workers, content scripts injected into Meteora, Polymarket, and Hyperliquid, authentication flows, message handling between browser contexts, data streaming connections, and all third-party dependencies.

## What This Means for You

<CardGroup cols={2}>
  <Card title="Your keys, your control" icon="key">
    The extension never touches your private keys, seed phrases, or passwords. Wallet interactions are strictly read-only.
  </Card>

  <Card title="Encrypted connections" icon="lock">
    All data between the extension and MetEngine servers travels over encrypted channels.
  </Card>

  <Card title="Verified message handling" icon="shield-check">
    The extension validates where every internal message comes from before acting on it.
  </Card>

  <Card title="Clean logout" icon="right-from-bracket">
    When you log out, your session ends on both the extension and the server. No lingering connections.
  </Card>
</CardGroup>

## Full Report

<Card title="Read the complete audit report" icon="file-pdf" href="https://metengine.xyz/audit">
  14-page PDF with detailed findings, code samples, and fix verification from the auditor.
</Card>

<Tip>
  Found something off? Reach out to [us](mailto:hello@metengine.xyz).
</Tip>