Connector Security
What the connector may send
Only data needed to reproduce the Mining Wars Live screen.
- Round, block, cycle, league and multiplier identifiers
- Clan identifiers, public clan names, power and calculated score
- Round lifecycle, winner and approved boost events
- Connector version, build hash and anonymous installation ID
- SHA-256 hash of the private viewer code - never the raw code
What must never be uploaded
These categories are blocked by the bridge and rejected again before upload.
- GoMining email address, password, cookies or bearer tokens
- Request headers, login form values or raw websocket frames
- Wallet actions, payments, boosts or other account actions
- Documents, photos, browser history or unrelated computer files
- Clipboard reads, screen capture, camera, microphone or location
How you can check the connector yourself
Security is strongest when the installed artifact can be connected to public evidence.
The one ZIP contains the connector, page bridge, redactor, schemas, security tests and server ingestion validator.
Compare the complete ZIP checksum with the download page. The included release record separately binds the exact installer hash.
The included test launches the packaged app and confirms TokenIsAppContainer = true. Reviewers can repeat it on a clean Windows VM.
The same ZIP includes locked dependency files and a Microsoft-generated SPDX software bill of materials.
The connector shows a visible data log. Only documented projected events should appear; forbidden material causes rejection.
The one ZIP contains the signed MSIX, unpacked payload, source snapshot, server boundary, hashes, test evidence and external checklist. Its verdict is still pending.
Use the connector directly or inspect the evidence your way
No AI or third-party service is required. If you want an additional review, copy the review request from the connector and use any AI, scanner or reviewer you trust. Only a valid signed code can add a verified status.
Confirmed only when the independent audit proves that passwords, cookies, session tokens, Authorization headers and 2FA codes cannot leave the browser boundary.
The user is always warned to enable 2FA. Smart Miners never asks for the password or the 2FA code.
Confirmed only for the exact audited AppContainer package with a dedicated WebView2 profile and no broad computer permissions.
The complete package SHA-256 must equal the approved release published on smartminers.xyz. This verifies the file, not the browser download route.
Only the protected audit service can sign a code bound to this package, version, installation challenge and approved audit period. The connector verifies it locally.
The present release candidate is still awaiting an independent verdict and protected production signer, so code issuance remains disabled.
What the embedded browser means
The login page runs in Microsoft's Edge WebView2 Chromium runtime inside the connector. The connector never asks for a GoMining password in its own native interface. However, because Smart Miners hosts that browser window, malicious connector code could technically inspect page content. Open source, a reproducible build, strict origin checks, sandboxed packaging and independent review are therefore required; the appearance of a browser alone is not proof.