Am/example/tvc chainalysis by am-hernandez · Pull Request #1 · tkhq/tvc-examples

am-hernandez · 2026-06-24T17:54:23Z

adds TVC-Chainalysis Example

Imports a new Turnkey Verifiable Cloud example application: tvc-chainalysis.

This app mocks calls to Chainalysis for OFAC sanctions screening, demonstrating how to run a verifiable screening service on TVC.

Details

Added under tvc-chainalysis/ via git subtree (full history preserved).
Contains two apps:
- apps/tvc-app — Go service (the verifiable workload + proof generation)
- apps/web — Next.js frontend (screening UI, send-ETH flow, proof badge)
The example's README.md is a full walkthrough/guide for building, deploying, and verifying the TVC app
- guide covers Turnkey dashboard and CLI routes

…ound in dev

…nents

…nd boot proofs

… tidy go.mod

… to 1.26

…est and deploy commands in README

…af03a90' git-subtree-dir: tvc-chainalysis git-subtree-mainline: 55e3e1b git-subtree-split: f64f4ea

socket-security · 2026-06-24T17:58:53Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/next@16.2.10
	npm/eslint-config-next@16.2.4
	npm/@types/better-sqlite3@7.6.13
	golang/golang.org/x/crypto@v0.52.0
	npm/@types/react-dom@19.2.3
	npm/@types/react@19.2.14
	npm/@types/node@20.19.39
	npm/@turnkey/react-wallet-kit@1.11.1
	npm/tailwindcss@4.2.2
	npm/react@19.2.5
	npm/drizzle-orm@0.30.10
	npm/@turnkey/sdk-server@1.7.3
	npm/better-sqlite3@12.9.0
	npm/zod@4.4.3
	npm/typescript@5.9.3
	npm/react-dom@19.2.5
	npm/drizzle-kit@0.21.4
	npm/eslint@9.39.4
	npm/@tailwindcss/postcss@4.2.2

View full report

socket-security · 2026-06-24T17:58:55Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@esbuild/aix-ppc64` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/drizzle-kit@0.21.4` → `npm/@esbuild/aix-ppc64@0.19.12` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@esbuild/aix-ppc64@0.19.12`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@internationalized/date` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/@turnkey/react-wallet-kit@1.11.1` → `npm/@internationalized/date@3.12.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@internationalized/date@3.12.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@noble/hashes` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/@turnkey/react-wallet-kit@1.11.1` → `npm/@turnkey/sdk-server@1.7.3` → `npm/@noble/hashes@1.8.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@noble/hashes@1.8.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `@noble/hashes` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/@turnkey/react-wallet-kit@1.11.1` → `npm/@turnkey/sdk-server@1.7.3` → `npm/@noble/hashes@1.8.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@noble/hashes@1.8.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `better-sqlite3` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/apps/web/package.json → `npm/better-sqlite3@12.9.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/better-sqlite3@12.9.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `brace-expansion` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/eslint-config-next@16.2.4` → `npm/brace-expansion@5.0.5` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/brace-expansion@5.0.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `caniuse-lite` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/eslint-config-next@16.2.4` → `npm/next@16.2.10` → `npm/@turnkey/sdk-server@1.7.3` → `npm/caniuse-lite@1.0.30001788` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001788`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `caniuse-lite` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/eslint-config-next@16.2.4` → `npm/next@16.2.10` → `npm/@turnkey/sdk-server@1.7.3` → `npm/caniuse-lite@1.0.30001788` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001788`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `caniuse-lite` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/eslint-config-next@16.2.4` → `npm/next@16.2.10` → `npm/@turnkey/sdk-server@1.7.3` → `npm/caniuse-lite@1.0.30001788` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/caniuse-lite@1.0.30001788`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `commander` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/drizzle-kit@0.21.4` → `npm/commander@9.5.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/commander@9.5.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `damerau-levenshtein` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/eslint-config-next@16.2.4` → `npm/damerau-levenshtein@1.0.8` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/damerau-levenshtein@1.0.8`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `es-abstract` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/eslint-config-next@16.2.4` → `npm/es-abstract@1.24.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/es-abstract@1.24.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Protestware or unwanted behavior: npm `es5-ext` Note: The script attempts to run a local post-install script, which could potentially contain malicious code. The error handling suggests that it is designed to fail silently, which is a common tactic in malicious scripts. From: tvc-chainalysis/pnpm-lock.yaml → `npm/drizzle-kit@0.21.4` → `npm/es5-ext@0.10.64` ℹ Read more on: This package \| This alert \| What is protestware? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Consider that consuming this package may come along with functionality unrelated to its primary purpose. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/es5-ext@0.10.64`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `eslint-plugin-react` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/eslint-config-next@16.2.4` → `npm/eslint-plugin-react@7.37.5` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/eslint-plugin-react@7.37.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `jiti` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/eslint@9.39.4` → `npm/@tailwindcss/postcss@4.2.2` → `npm/jiti@2.6.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/jiti@2.6.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `next` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/@turnkey/sdk-server@1.7.3` → `npm/next@15.5.20` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/next@15.5.20`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `node-fetch-native` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/@turnkey/react-wallet-kit@1.11.1` → `npm/node-fetch-native@1.6.7` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/node-fetch-native@1.6.7`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `string.prototype.trimend` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tvc-chainalysis/pnpm-lock.yaml → `npm/eslint-config-next@16.2.4` → `npm/string.prototype.trimend@1.0.9` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/string.prototype.trimend@1.0.9`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

richardpringle

Basically all nits. I do think you should consider my comments, but I think it would be better to apply changes in a follow up

richardpringle · 2026-06-29T19:11:03Z

+func (c *ChainalysisClient) CheckAddress(ctx context.Context, address string) (*chainalysisResponse, error) {
+	if mocked, ok := mockedAddresses[strings.ToLower(address)]; ok {
+		return mocked, nil
+	}


I'm not sure this really matters, but it's a little strange to me that the request either goes to the real Chainalysis OR you get a cached mock-response. I would have a mock-client that gives back 100% mocked responses or a real client, not a combination of the two.

My thinking here was that I can get mocked responses for two addresses, one sanctioned and one not sanctioned. And any other address would actually attempt to call Chainalysis API. The latter case remained so that I can view the error thrown and in case egress became available, but it was more useful during testing than it is right now. I agree it should be 100% mock response now, and I can always update in the future for egress availability.

richardpringle · 2026-06-29T19:22:12Z

+	mux.HandleFunc("GET /health", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		fmt.Fprintln(w, `{"status":"ok"}`)
+	})


When I'm looking at examples, I often want to look at the meat of the example and ignore the boilerplate. If would be nice if instead of using a closure here that we just had a func healthcheck.

richardpringle · 2026-06-29T19:25:22Z

+		if identifications == nil {
+			identifications = []Identification{}
+		}


You could add this normalization to the chainalysis client. It might also be good to add a comment as to why it's needed

richardpringle · 2026-06-29T19:26:46Z

+	})
+
+	// Screen an address for sanctions.
+	mux.HandleFunc("POST /screen", func(w http.ResponseWriter, r *http.Request) {


It would also be good if we had a named function instead of a closure for this

richardpringle · 2026-06-29T19:30:28Z

+
+const ephemeralKeyFile = "/qos.ephemeral.key"
+
+// QOS derive paths — must match qos_p256/src/lib.rs


this should probably be a permalink or a link to the docs:
https://docs.rs/qos_p256/0.10.2/qos_p256/constant.P256_ENCRYPT_DERIVE_PATH.html

richardpringle · 2026-06-29T20:05:52Z

+| `TURNKEY_API_PRIVATE_KEY` | Same (shown once on creation) |
+| `TURNKEY_ORG_ID` | Turnkey dashboard → Settings → Organization |
+| `NEXT_PUBLIC_TURNKEY_ORG_ID` | Same as above |
+| `NEXT_PUBLIC_AUTH_PROXY_CONFIG_ID` | See Step 2 below |


Why not set up the Auth Proxy before setting the .env file?

richardpringle · 2026-06-29T20:07:27Z

+4. On success `authState` becomes `Authenticated` and the screening tool appears
+5. Sign-out calls `logout()` from `useTurnkey()` — no server-side session involved
+
+Authentication is entirely client-side via `@turnkey/react-wallet-kit`. No cookies, no JWTs, no custom session management.


Is this a plug? Do we want to link docs for those interested?

richardpringle · 2026-06-29T20:08:53Z

+| `0x1da5821544e25c636c1417ba96ade4cf6d2f9b5a` | Sanctioned (OFAC SDN — Secondeye Solution) |
+| `0xffc93b73e5f9fa038598b675ed394faed168688b` | Clean |
+
+Any other address will attempt the real Chainalysis API call (which will fail inside the enclave until egress is enabled).


richardpringle · 2026-06-29T20:12:18Z

+3. Paste your operator public key (from `tvc login`)
+4. Click **Create new TVC App**
+
+### Option B — CLI


Wait, we shouldn't push the audience to download and build the cli from source if they use the UI. I think we can just point them to the tvc readme for installation here.

Connected to the earlier comment on the options for installing the tvc CLI, the audience require the CLI to login and obtain the operator key and API public key. I wanted this readme to cover both dashboard and CLI flows originally, but the first step and the approval step require the CLI in either flow.

I am adding a link to the tvc readme in the prerequisites so that the audience is always able to get the current installation instruction.

richardpringle · 2026-06-29T20:14:09Z

+
+---
+
+## Database schema


Better to just link to the file here, otherwise it'll be confusing if the file gets updated and this gets out of sync.

…g key file

…monorepo

…path

am-hernandez added 29 commits April 17, 2026 18:30

chore(repo): init

27702eb

feat(tvc-app): add Go sanctions screening service

16e50f5

feat(web): add Next.js app with Turnkey passkey auth and sqlite db

f4342f4

refactor: componentize wallet address and logout button in Header

4562269

refactor(chainalysis): add mock call to chainalysis for egress workar…

e1b85e3

…ound in dev

feat(tvc-app): sign screening results with enclave ephemeral key

3eaecb5

docs: add readme

ef7dbdf

chore: add local db reset command

ff959bb

feat(web-app): add app proof and boot proof

a5fd6c5

chore: clean up console log

c502dc5

refactor(web-app): add LoginButton component

0a9b22a

refactor(web-app): add ScreenedTransaction and ScreeningHistory compo…

c605270

…nents

refactor(web-app): add SendEth component

37cc55a

refactor(web-app): update ProofBadge and screen route to handle app a…

c348f6c

…nd boot proofs

docs(readme): add app proofs to readme

634c55f

chore(web): use env var for apiBaseUrl

11c0f5c

fix(tvc-app): reproducible build — pin builder digest, add -trimpath,…

c08e8b5

… tidy go.mod

docs(readme): add reproducible builds section, update Go prerequisite…

1e898ac

… to 1.26

docs(readme): add table of contents

3950757

docs: ignore TVC-generated deploy and app config files, fix image dig…

3bf37a1

…est and deploy commands in README

docs(readme): expand deploy and approval steps with CLI output examples

27910a0

fix: correct ScreeningTool types to match API response shape

56d7ee2

fix(web): use persistent volume for SQLite and auto-migrate on startup

f5002dc

fix(web): auto-create DB schema on startup

8f19cec

fix(web): lazy-init DB to avoid build-time file open failure on Railway

fff8be4

chore(web): restrict auth methods to passkey and email OTP only

3c6fafb

chore(web): remove NEXT_PUBLIC_BASE_URL from env example

b66e64c

docs: add live demo URL to readme

f64f4ea

Add 'tvc-chainalysis/' from commit 'f64f4ea0d89f5d687cf8543d129e0a7b1…

24bc69d

…af03a90' git-subtree-dir: tvc-chainalysis git-subtree-mainline: 55e3e1b git-subtree-split: f64f4ea

richardpringle previously approved these changes Jun 29, 2026

View reviewed changes

am-hernandez added 22 commits July 10, 2026 18:43

refactor(tvc-app): always call real Chainalysis API, drop mock hybrid

8f7adda

refactor(tvc-app): extract healthcheck handler into named func

f750399

refactor(tvc-app): normalize identifications in chainalysis client

6a675fd

refactor(tvc-app): extract screen handler into named method on server

809cea9

docs(tvc-app): link qos_p256 derive-path constants to docs.rs

4750fe0

docs(tvc-app): explain why loadEphemeralSigningKey tolerates a missin…

fae5e32

…g key file

refactor(web): extract get_boot_proof request/response types

0e771d0

feat(web): validate screen request body with zod

88065af

chore(web): update gitignore

7d7bacf

refactor(web): extract findOrCreateUser helper

c8fc67a

fix(web): include SDK callbacks in wallet-bootstrap effect deps

178dd6c

chore(web): add eslint flat config, run eslint directly for next 16

a71d1ff

fix(web): clear eslint errors in SendETH

cb350bd

refactor(web): extract unauthenticated flow into LoginPrompt component

4350475

refactor(web): rename lib/tvc.ts to tvc-app.ts

f62e4cf

fix: add newline at end of files

f8530df

docs(readme): drop pivot from tvc-app description

aa2de62

fix(readme): correct clone instructions to point at the tvc-examples …

6dac540

…monorepo

docs(readme): set up Auth Proxy before env file and fix .env.example …

013b300

…path

docs(readme): link Embedded Wallet Kit getting-started guide

a7fd30b

docs(readme): link to tvc readme for current install instruction

a1108e5

docs(readme): link db schema file instead of inlining the SQL

f8fccc9

am-hernandez dismissed richardpringle’s stale review via f8fccc9 July 13, 2026 00:56

am-hernandez added 3 commits July 12, 2026 21:13

fix(tvc-app): bump golang.org/x/crypto to v0.52.0 for CVE fixes

afeaa82

chore(docker): copy go.sum explicitly before go mod download

3e97d73

fix(web): bump next to 16.2.10 for security patches

7bae609

am-hernandez requested a review from richardpringle July 13, 2026 12:54


		const ephemeralKeyFile = "/qos.ephemeral.key"

		// QOS derive paths — must match qos_p256/src/lib.rs

Uh oh!

Conversation

am-hernandez commented Jun 24, 2026

adds TVC-Chainalysis Example

Details

Uh oh!

socket-security Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

richardpringle left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

socket-security Bot commented Jun 24, 2026 •

edited

Loading

socket-security Bot commented Jun 24, 2026 •

edited

Loading