copay

Here is some code on GitHub that does call site checking using SemGrep: https://github.com/lunasec-io/lunasec/blob/master/lunatrace/... (Note: I helped write that. We're building a similar service to the r2c one.) You're right that patching is hard because of opaque package diffs. I've seen some tools coming out like Socket.dev which show a diff between versions. https://socket.dev/npm/package/react/versions But, that said, this is still a hard problem to solve and it's happened before that malware[0][1] has been silently shipped because of how opaque packages are. 0: https://web.archive.org/web/20201221173112/https://github.co... 1: https://www.coindesk.com/markets/2018/11/27/fake-developer-s...

Funny thing is: They did actually lock down the version numbers of dependencies, they just didn't bother to check the updated dependencies: https://github.com/bitpay/copay/commit/6cc4b757f6fbd111b9716...

I understand is a label, but some bad devs might use it as a way of matching the user, and end users might get confused especially when you can write any email as there is no verification for it in place. Let them choose it, or you make the first one to speed up the process and let them edit it if they don't like "Account 1". In terms of master password, what do you think is easier to write down as a backup? This: ?A[ZSOO{PBs&Y]5.6iwm=_t}]t<DOk Or this: remove maple runway unable empty little swing zebra lava interest secret admit To create this you can even use the bitcoin libraries, so you don't have to write your own, and you will only need to work on the clients. If you do it similar to what Trezor did but on a desktop app, you're protocol is built for the web pretty fast. If is good for money is definitely good for Facebook/Twitter/w

Take a look at Copay. https://github.com/bitpay/copay This is a AngularJS bitcoin wallet. To me the real benefit of an SPA is using your web skills to build a GUI that can then run on different platforms. Take a look at ionic and some of the tutorials there.