Dugout is a read-only desktop app. This page tells you exactly what it does and does not do, and how to report a vulnerability if you find one.

• Sends POST requests to https://api.hyperliquid.xyz/info with the wallet address you paste, asking "what positions and balances does this address have?".
• Sends GET requests to https://data-api.polymarket.com with the Polymarket proxy address you paste, asking "what positions does this account hold and what are they worth?".
• Loads two web fonts (Inter, JetBrains Mono) from fonts.googleapis.com at startup.
• Opens polymarket.com links in your default browser when you click a prediction row.

• Never asks for keys. No private key, no seed phrase, no signing prompt anywhere. The app's source has zero signing code paths. Search the repo for signTypedData or personal_sign: there are no matches.
• Never holds funds. No wallet integration, no contract calls, no withdrawals, no transfers, no order placement. Both venues' trade endpoints are intentionally unused.
• No telemetry. No analytics, no crash reporting, no "phone home" of any kind.
• No auto-update channel in v0.x. New versions are released manually on GitHub. Nothing is fetched and executed in the background.
• No backend. There is no Dugout server. Every request is from your machine to the Hyperliquid public API, the Polymarket public data API, or the Google Fonts CDN.

Every outbound network call lives in src/lib/hl.ts and src/lib/polymarket.ts. They are short and readable. Anyone with a few minutes can confirm there is nothing else.

You can also build the app yourself from source (Install) and watch the dev tools network tab: you will only see hits to api.hyperliquid.xyz, data-api.polymarket.com, and fonts.googleapis.com / fonts.gstatic.com.

Tagged releases carry a GitHub artifact attestation: a cryptographic stamp proving the binary was produced by this repository's CI on a specific commit.

To verify a download:

gh attestation verify Dugout_<version>_aarch64.dmg --owner ramenxbt

A green checkmark means the file you downloaded was built by GitHub Actions from ramenxbt/dugout and has not been modified since. Any tampering breaks the signature.

If you find a security issue, please do not open a public GitHub issue. Instead:

• Email ramenxbt@proton.me with [dugout security] in the subject.
• Or use GitHub's private vulnerability reporting for this repo.

You can expect:

• An acknowledgement within 72 hours.
• A patch and a CVE if the issue is real, before any public disclosure.
• Credit in the changelog if you would like it.

In scope:

• Code execution, key exfiltration, unintended outbound traffic, supply-chain compromise of the build pipeline, malicious update vectors.

Out of scope:

• Issues that require physical access to a user's unlocked machine (which already breaks the trust model of any local app).
• Bugs in Hyperliquid's or Polymarket's APIs themselves (report those to Hyperliquid or Polymarket).

Pre-v1.0 binaries are not signed by Apple or Microsoft, so macOS Gatekeeper and Windows SmartScreen will warn on first launch. Signed builds are part of the v1.0 release pass:

• macOS: Apple Developer Program enrollment, Developer ID Application + Installer signing, notarization.
• Windows: EV Code Signing certificate.
• Linux: AppImages and .deb / .rpm will continue to be unsigned (standard for the platform); release artifacts will publish SHA256 checksums.

Until then: build from source if you want zero warnings.