Prepare a launch or operational handover
Trace the route from source changes to the published frontend and privileged deployment. Confirm release authority, dependencies and a recovery owner before increasing exposure.
Work through the guide ↗Crypto OpSec / Field manual
Who can change
the outcome?
Operational security connects the people, accounts and systems that can move value or change a protocol. A multisig threshold is one control. Devices, recovery, domains and deployment authority need their own review.
Start with a change
Three useful entry points.
Choose a real operational decision. Follow its dependencies before checking individual settings.
Change a team member or signer
Check active permissions, recovery paths and delegated access alongside the personnel change. Rehearse signer availability and removal with approved procedures; a closed team account does not establish that every grant was revoked.
Work through the guide ↗Investigate a suspicious treasury or admin action
Name the incident decision-maker, preserve transaction and account evidence, and establish what is known before recovery changes erase context. Use the agreed private escalation path; this guide is not a live response channel.
Work through the guide ↗Owner / Control / Evidence
A useful review leaves
something to verify.
Use this as a preparation brief, then agree a scope that matches your treasury, team and infrastructure. Keep sensitive inventories and evidence in your own approved system.
Use test credentials and controlled exercises. Never put seed phrases, private keys or recovery codes in a checklist, contact message or shared document.
- Name an owner for each critical asset and record who can change its permissions, recover access or authorize an emergency action.
- Inventory treasury and protocol-administration wallets, owners, thresholds and enabled modules or delegates; assign independent review of consequential transaction details.
- Separate signing from routine browsing and development where practical; document approved devices, software and a lost-device procedure without placing recovery secrets in the inventory.
- Protect privileged identities with phishing-resistant MFA where supported, review recovery dependencies and test an approved fallback using a synthetic account or controlled exercise.
- Reconcile joiner, role-change and departure records with actual identity-provider, GitHub, cloud, registrar and wallet authority; include service tokens and active sessions.
- Confirm domain ownership, renewal and recovery contacts, registrar protections and available registry locks; review who can change DNS, email routing and the public frontend.
- Trace an approved source change through CI/CD to deployment; review dependency execution, workflow permissions, release approvals and who can override them.
- Assign secret owners and consumers, narrow access and retention, and demonstrate revocation or expiry with a test credential rather than exposing a production secret.
- Send representative privileged-change and security alerts to an accountable recipient; record delivery, useful context, log retention and the escalation path when the first contact is unavailable.
- Rehearse one realistic failure, such as an unavailable signer or compromised deploy account; record decisions, recovery prerequisites, verification evidence and a date to retest unresolved actions.
Component guides
Review the whole operation.
Nine practical guides covering people, signing and infrastructure. Each includes checks, failure drills and primary references.
Treasury & signingguide
Multisig treasury operations: verify the transaction and every path around the threshold
An operating runbook for signer independence, privileged transactions, modules, monitoring and recovery rehearsal.
Identityguide
Identity security: phishing-resistant login, usable recovery and verified offboarding
An operating procedure for the accounts that control email, cloud infrastructure, source code and company recovery.
Devicesguide
Developer device security: isolate experiments from production authority
A practical baseline for laptops that handle source code, external repositories, credentials and sensitive client material.
Domains & DNSguide
Domain and DNS security: preserve control of the address your users trust
A runbook for registrar ownership, scoped DNS changes, renewal resilience and safe nameserver recovery.
Frontend & third-party codeguide
Frontend security: review every script that can change what a user sees
A practical review of browser code, tag managers and content security policies, including the interactions a successful build can still break.
GitHub & CI/CDguide
GitHub and CI/CD security: keep untrusted changes away from deployment authority
A review procedure for workflow triggers, action revisions, runner isolation and cloud deployment identity.
Cloud & secretsguide
Cloud IAM and secrets: reduce standing access and prove revocation
An operating model for human roles, workload identities, secret consumers and emergency cloud access.
Monitoringguide
Security monitoring: connect important events to an owner who can act
Build a small, testable detection system around identity changes, deployments, data access and treasury authority.
Incident readinessguide
Incident tabletop: rehearse decisions while the systems are still healthy
A repeatable exercise format for founders, engineering, security, support and the people authorized to stop operations.
Frameworks / Further reading
Start from established controls.
Verify your implementation.
- SEAL: Multisig Security Framework ↗
- SEAL: Domain & DNS Security framework, authored by Raiders ↗
- OWASP: Secrets Management Cheat Sheet ↗
- SEAL: Certification Framework and accredited certification process ↗
This field manual is an independent educational resource. Reading it or completing the brief does not establish certification, audit coverage or incident-response availability.
See the assessment scope and handoff ↗