AllowanceGuard

Open-source Web3 wallet security.
Scan any wallet for active token approvals across 27 EVM chains, score each approval's risk, and revoke dangerous ones in a single signed transaction.

Live • Docs • API • Pricing

Does. Reads the approval state of any EVM wallet you point it at. Surfaces unlimited approvals, approvals to unknown spenders, and approvals to contracts associated with known exploits. Lets the wallet owner revoke any or all in a single signed transaction where the chain supports batching (EIP-5792), or sequentially elsewhere. A separate browser extension shows the same signals before you sign an approval in a dApp.

Does not. Block transactions, audit smart contracts, guarantee any spender is safe, detect every form of wallet compromise, or replace the confirmation screen in your wallet. Warnings are advisory. Your wallet remains in control.

Non-custodial by design: we never ask for private keys or seed phrases. Scanning reads public chain data. Revocations are signed in your wallet, by you.

Free: the core scanner. Three wallets. All 27 chains. Always open source.

Paid (Pro / Sentinel / API Developer / API Growth / API Enterprise): continuous monitoring, batch revoke, audit exports, team dashboards, higher API limits. Priced in USD, billed via Stripe. See pricing.

27 EVM networks as of this revision: Ethereum, Arbitrum, Base, Optimism, Polygon, Avalanche, BNB Smart Chain, Fantom, zkSync Era, Polygon zkEVM, Mantle, Gnosis, Linea, Scroll, Celo, Blast, Cronos, Moonbeam, Aurora, opBNB, Manta, Mode, Taiko, Metis, Kava, ZetaChain, Worldchain.

Authoritative list: src/lib/networks.ts. Add-a-chain runbook: memory/product-engineering/chain-support.md.

pnpm install
cp .env.example .env.local    # fill in DATABASE_URL + NEXT_PUBLIC_APP_URL at minimum
pnpm dev                      # http://localhost:3000

Full dev guide: docs/operator/DEPLOYMENT.md.

src/app/                    Next.js 15 App Router — pages, API routes, middleware
src/components/             UI components (Ledger design system)
src/lib/                    shared libs — db, auth, billing, risk, chains
migrations/                 numbered SQL migrations (001..NNN_<slug>.sql)
extension/                  browser extension (MV3, Chrome + Firefox)
packages/client/            @allowance-guard/client — TypeScript SDK
packages/react/             @allowance-guard/react — React hooks on the SDK
docs/operator/              ops runbooks (deploy, cron, webhooks, monitoring)
docs/legal/                 internal legal references
docs/archive/               superseded plans and historical docs
memory/                     project memory loaded by Claude-agent workflows
projects/allowanceguard/    product truth — ARCHITECTURE, BUSINESS, DESIGN, STATUS
scripts/                    migrations runner, image generator, smoke tests, publish

Next.js 15 (App Router) · TypeScript 5 · React 19 · PostgreSQL via Neon serverless HTTP · Upstash Redis (rate limit + metrics) · Stripe (subscriptions) · wagmi + Reown AppKit (wallet) · viem (chain calls) · Jest (unit) · Playwright (e2e).

Observability: Rollbar for errors, structured JSON logs, /api/healthz for uptime probes.

Report vulnerabilities privately to security@allowanceguard.com. Full policy in SECURITY.md.

Production hardening highlights (see SECURITY.md for the full list):

• No keys, seeds, or PII ever touch our systems — scanning reads public chain data only.
• Sessions are opaque, rotating, HTTP-only cookies; CSRF on every state-changing consumer request.
• Per-endpoint rate limiting (Upstash); fail-open on provider outages so a Redis hiccup cannot take payment flows down.
• Webhook signatures verified on every Stripe callback; no unsigned payload path.
• Strict CSP, X-Frame-Options DENY, HSTS preload.

Code contributions welcome. Before you open a PR:

1. Read CONTRIBUTING.md.
2. Agree to the CLA.md (the PR template prompts you). Organisations: CORPORATE_ADDENDUM.md.
3. Write tests. pnpm test must stay green; pnpm exec tsc --noEmit must be zero errors.
4. Keep claims about the product calibrated and sourced. No absolute-security language.

Non-trivial changes are reviewed through the Standing Council defined in CLAUDE.md — editorial, security, legal, accessibility, performance, investor voice, and more. Reference the members whose vetos apply.

Code of Conduct: CODE_OF_CONDUCT.md.

Dual-licensed. See LICENSE_STRATEGY.md for the rationale.

• AGPL-3.0-or-later for open-source use. If you run a modified version as a service, you must publish the source under the same license.
• Commercial license for closed-source / SaaS use without the AGPL obligation. Contact legal@allowanceguard.com.

All files carry LICENSE_HEADER.txt where applicable.

Built on Ethereum, Next.js, Vercel, Neon, Upstash, Stripe, Reown, wagmi, viem, Tailwind, lucide-react, and a lot of coffee.

• General: support@allowanceguard.com
• Security: security@allowanceguard.com
• Legal: legal.support@allowanceguard.com
• Sales / Enterprise: support@allowanceguard.com
• Issues & feature requests: github.com/EazyAccessEA/Allowance-guard/issues

_{Open source core · AGPL-3.0 · Independently operated · Built to last}