Private key management
- Never commit private keys to version control
- Use environment variables or a secret manager (AWS Secrets Manager, HashiCorp Vault)
- Rotate keys periodically
- Use separate keys for testnet and mainnet
Database security
- Enable SSL/TLS for database connections
- Use strong passwords (minimum 32 characters)
- Restrict database access to the settler agent’s IPs only
- Enable audit logging
- Test backups regularly
Network security
- Use VPCs / private networks
- Restrict inbound traffic to necessary ports only
- Enable DDoS protection
- Apply firewall rules
Monitoring and alerts
- Alert on failed transactions, low gas balances, database connection issues, and high error rates
- Monitor logs for suspicious activity
- Track settlement success rates