Security best practices

Identity and permissions

• Follow the principle of least privilege for cross-chain authorization.

• Follow the principle of least privilege for account settings.

• Assign permissions to user groups to separate duties and quickly change permissions.

• Regularly review and remove unnecessary users, roles, permissions, keys, and credentials. Rotate keys for users and applications periodically.

• Do not expose your AccessKey ID and AccessKey secret. Do not hardcode your AccessKey in plaintext into your code or publish it to platforms such as GitHub. Do not store your AccessKey in a location that is accessible to other users.

• Change your password regularly. Ensure new passwords meet strength requirements.

• Set a complex and unique password for your account that is different from the passwords you use on other platforms. This practice prevents a data leak on one platform from affecting your resources on other platforms. Do not share passwords or key pairs between different accounts on the same host.

Data security and protection

• Use on-chain smart contracts that have passed security scans.

• Avoid storing sensitive data on-chain. If you must store sensitive data on-chain, ensure that it is adequately protected.

Monitoring and auditing

• Audit account operations regularly.

• Use Alibaba Cloud services such as ActionTrail to record management console operations and OpenAPI call logs for your account.