Release checksums
Each release ships SHA256SUMS. Compare your file before you run it.
Open source
Don’t trust it. Read it.
The interface, the Rust core and the app shell are all public under GPL-3.0-or-later. Here is how to read, build and verify what you run.
Read
Where to start
A small map of the repository. Keys live in one place, and it has no network access.
| Path | What it holds |
|---|---|
crates/wallet-core | Pure Rust: vault, BIP39 and BIP32, derivation, decoding, signing. No network, no files |
apps/desktop/src-tauri | Tauri 2 shell: commands, session and auto-lock, filtered network access, native windows |
apps/desktop/src | React and strict TypeScript interface. No secrets |
packages/chains | Chain adapters that build unsigned transactions |
packages/swap | Swap providers and fee logic |
docs/ | Architecture, IPC contract, network requests, swap fees |
Build
Build it yourself
You need Rust 1.97.1, which rustup installs from the pinned toolchain file, Node.js 22+, pnpm 11 and the Tauri prerequisites for your system.
- Dependencies are pinned to exact versions, with committed lockfiles.
- CI runs
cargo audit,cargo denyandpnpm audit. - Before a PR:
pnpm lint,pnpm typecheck,pnpm test.
Verify
What you can check today
Three things you can verify, and one you cannot yet.
Signed updates
Each update is signed. Kyro verifies it against a public key pinned in the app, and refuses a bad signature.
Servers contacted
Every server is listed in NETWORK.md, and any new one has to be added there.
Not yet
Bit-for-bit reproducible builds are a goal, not a guarantee. The installers are not code-signed yet.
Contribute
Help make it better
Issues and pull requests are welcome.
- Run
pnpm lint,pnpm typecheckandpnpm testbefore opening a pull request. - Any new server Kyro contacts must be listed in
docs/NETWORK.md. - Changes to the IPC contract belong in
docs/IPC.md. - Never post a recovery phrase, private key or password in an issue, pull request or log.
Report a vulnerability
Please do not open a public issue. Report privately to [email protected] or through GitHub security advisories, with a proof of concept if you can. Reports are acknowledged within 72 hours, with a fix and coordinated disclosure within 90 days at most.
Questions
Common questions
What licence is Kyro under?
GPL-3.0-or-later. You can read, run, change and share it. If you distribute a changed version, it stays under the same licence, with its source.
Are Kyro builds reproducible?
Not bit for bit yet. It is a goal, not a guarantee. Today you can verify the SHA-256 of a release and build from the same source yourself.
Can I remove the swap fee?
Yes, in your own build. The rates live in packages/swap/src/fees.ts, and anyone can change them or set the fee to 0.
Has Kyro been audited?
An internal security review has been done. No independent external audit has been published yet. Like all GPL software, Kyro comes with no warranty.
Keep reading
How Kyro protects your keys
The three layers, and what no software can do.
Changelog
What changed in each release.
Brand kit
Logos and colours for writing about Kyro.
Get Kyro
Version 1.0.7 · Free · Windows, macOS and Linux