Corisco Back to home

Last updated 31 October 2026

Security

Corisco is built on one idea: your phone talks to the network, and a separate device holds the keys. This page covers how that works, how to stay safe, and how to report a problem.

How Corisco protects your keys

  • Your recovery words and private keys are created on the hardware signer and stay there.
  • The app sends unsigned requests to the device over Bluetooth. Only signatures come back.
  • The device is locked with a PIN and wipes itself after too many wrong attempts.
  • Payments use Spark's FROST threshold signing, so a payment needs both your device and the Spark operators to sign.
  • All code is open source, so anyone can review it on GitHub.

Signing modes

By default the device runs in Blind signer mode and signs without a tap. This is fast, but it means the device trusts requests from your paired phone. For more control, turn on tap confirmation (beta), so the device asks you to approve each signature on its screen.

Keeping your wallet safe

  • Write your recovery words on paper and store them offline. Never photograph them or type them into a computer.
  • Never share your recovery words or PIN. We will never ask for them.
  • Install the app and firmware only from our official GitHub releases.
  • Keep your phone's operating system and the Corisco app up to date.
  • If you lose your device, or think someone has accessed it, move your funds to a new wallet with new recovery words.
  • This is early software. Only use amounts you can afford to lose.

Reporting a vulnerability

Please report security issues privately, not in a public GitHub issue. Email info@corisco.org or use GitHub's private vulnerability reporting on the affected repository. Include:

  • the affected component (firmware, Android app, crypto-core or Lightning Address server);
  • steps to reproduce, or a description of the weakness if it needs hardware to reproduce;
  • what you think the impact is.

What counts as a security issue

  • Private keys or recovery words being exposed, derived, or leaving the device.
  • Bypassing or spoofing the on-device tap confirmation.
  • Connecting to the device or sending it signing requests without pairing.
  • Guessing the PIN without triggering the wipe.
  • The confirm screen showing one payment while a different one is signed.
  • Taking over or redirecting someone's Lightning Address.

Regular bugs, crashes and UI problems can go in public GitHub issues.

What to expect

Corisco is maintained by a small team, with no bug bounty or guaranteed response time yet. We'll acknowledge your report as soon as we can, keep you updated, and credit you once a fix ships if you'd like. Please give us reasonable time to fix an issue before you disclose it publicly. We won't take action against good-faith research that follows this policy and avoids harm to users and their funds.