# Security

## User safety rules

- Enter only the selected coin's public receiving address. A seed phrase, recovery phrase, private key, wallet password, or exchange password is never required to mine to a pool.
- Download the launcher only from the publisher's official release channel and verify the published SHA-256 hash.
- The Early Access executable is unsigned. Do not suppress operating-system security warnings blindly.
- Pool operators are independent third parties. Review pool fees, payout thresholds, location, reputation, and terms before connecting.

## Launcher protections

- The local dashboard binds to `127.0.0.1` on a random port.
- State-changing API requests require a cryptographically random per-launch token.
- Host and Origin checks reduce browser and DNS-rebinding attacks.
- Content Security Policy blocks third-party scripts and framing.
- XMRig is retrieved over HTTPS from the official `xmrig/xmrig` GitHub release.
- The downloaded archive is checked against the official release's SHA-256 checksum file before extraction.
- SRBMiner-MULTI is retrieved over HTTPS from the official `doktor83/SRBMiner-Multi` GitHub release and checked against the GitHub asset SHA-256 when present or the digest published in the upstream release notes.
- The current SRBMiner package includes WinRing0 and may not start while that driver is quarantined. Microsoft classifies WinRing0 as a valid vulnerable-driver detection associated with CVE-2020-14979. BMM discloses this risk and explains how a user can restore and individually allow the verified driver, but never changes Defender settings or creates exclusions automatically.
- MO-Miner is retrieved from its official GitHub release and requires the SHA-256 published in GitHub's release-asset metadata before extraction.
- BzMiner is retrieved from the official `bzminer/bzminer` GitHub release. The experimental Warthog adapter is pinned to reviewed public-beta release v100.04b1 and requires its published SHA-256 before extraction.
- Mining engine binaries are downloaded only when the user installs or starts the corresponding workflow; they are not bundled into the BMM executable.
- Pool endpoints and worker names are validated before a configuration is generated.
- Every route is validated against its allowed engine and hardware type. CPU routes disable GPU mining, GPU routes disable CPU mining, recognized integrated graphics are excluded, and Warthog explicitly requires both the CPU and a supported discrete GPU.
- XMRig's local API uses a random access token. SRBMiner's documented local statistics API is assigned a random port and is accessed by the launcher through `127.0.0.1`.
- The miner runs as a child process and is stopped when the launcher exits normally.
- The BMM developer fee is capped locally at exactly 72 seconds per 7,200 seconds of counted active mining time. Public payout-address data cannot increase that percentage.
- Fee switching retains the selected coin, engine and pool, validates the BMM public address using the same coin rules as a user address, and restores the user's saved route if the fee process cannot start.
- Routes without a verified BMM public payout address are not redirected. No private key, seed phrase, pool password, withdrawal credential or exchange API key is included in the fee manifest.

## Limitations

The integrity metadata and archive currently share the same GitHub release trust boundary. Some SRBMiner releases publish MD5 rather than a modern signed digest; this detects accidental corruption but is not a substitute for authenticated publisher signatures. Allowing WinRing0 increases the system's attack surface because the driver has a documented vulnerability; users who do not accept that risk should use another compatible engine or avoid that SRBMiner route. A production release should add signature verification or pin a reviewed release manifest. This Early Access build has not received an independent security audit. Antivirus software commonly classifies cryptocurrency miners as potentially unwanted applications even when the user intentionally installed them.

To report a vulnerability, contact the publisher privately and include the launcher version, Windows version, reproduction steps, and expected impact. Do not include wallet private keys or seed phrases.
