The security model in one paragraph#
Fullport Tap is a panel, not a wallet. Your evaluation balance is a number on Fullport's engine; when you press Buy, the extension sends an order to that engine and the engine prices it from a fresh read of the token's curve or pool. Nothing is signed, nothing is broadcast, and nothing on the terminal page is clicked on your behalf. The terminal provides the chart; the extension provides a second, simulated account beside it.
That is why the permission list is short and why the word wallet does not appear in the manifest at all. An extension that cannot reach your keys cannot lose them.
Every permission, in plain words#
| Permission | What it is for | What it cannot do |
|---|---|---|
| storage | Keeps your Fullport session and panel settings in extension storage. | Cannot read other extensions' storage or your browser's site data. |
| alarms | Wakes the service worker to sync resting orders and fills and to refresh the kill-switch config. | No network access of its own; it only schedules work. |
| notifications | A toast when a fill completes or a take-profit / stop-loss fires while you are on another tab. | Cannot read notification content from other apps. |
| host permissions (18 terminal domains) | Inject the panel on coin pages and read the token address from the URL. | Does not run on wallet sites, exchanges, email, banking or anything not in the list. |
Sites the extension may run on: pump.fun, gmgn.ai, padre.gg, bullx.io, jup.ag, birdeye.so, fomo.family, lute.gg, trojan.com, shotgun.fun, axiom.trade, tinyastro.io, dexscreener.com, telemetry.io, cielo.finance, azura.xyz, solpump.io, definitive.fi. Remote code: none. All code ships inside the package; the only JSON exchanged leaves for fullportcapital.co and fullport-engine.fly.dev.
What it reads, and what it never touches#
- Reads: the current page URL (to find the token or pool address), the Fullport session you created with one explicit click on /connect, and the panel settings you chose.
- Never touches: wallet extensions, seed phrases, private keys, the clipboard, form fields on the terminal, your transaction history, other tabs.
- Never does: click, submit or modify anything on the terminal page. The panel lives in a closed shadow DOM beside the page, not inside it.
By design, Tap only arms on a page whose URL carries a token or pool address. On feed pages (Axiom Pulse, the GMGN home page) it stays in HUD mode rather than guessing from page markup — guessing is how an overlay ends up trading the wrong coin.
Verify the build you installed#
- 1
Download only from this site or the Chrome Web Store
The hosted zip lives at fullportcapital.co/downloads; the store listing is linked from /tap once it is live. Any other host is not ours.
- 2
Check the SHA-256
On macOS or Linux run shasum -a 256 fullport-tap-<version>.zip; on Windows run certutil -hashfile fullport-tap-<version>.zip SHA256. Compare with the hash on /tap and in the ticket above.
- 3
Read the manifest
Unzip the file and open manifest.json. You will find the three permissions above and the terminal hosts — and nothing about wallets.
- 4
Connect with one click, on purpose
The extension only gets a session when you press Connect on fullportcapital.co/connect while signed in. It is a separate session you can revoke from your account settings at any time.
Report a vulnerability#
Write to fullportcapitalco@gmail.com with "security" in the subject, or use the contact in /.well-known/security.txt. We acknowledge within two business days.
Quick answers
- Is Fullport Tap safe to install?
- It requests no wallet permission and has no way to sign a transaction: there is no wallet adapter, no key handling and no injected provider in the code. The only network calls go to fullportcapital.co and the Fullport engine. The download's SHA-256 is printed on this page and on /tap so you can verify the file you installed.
- Can a Chrome extension steal from my Solana wallet?
- A malicious one can — by injecting into wallet pages, reading clipboard contents, or swapping addresses in the DOM. Tap does none of those things: it only runs on the terminal domains listed below, reads the token address from the URL, and draws its own panel in a shadow DOM that cannot see or alter the terminal's controls.
- Why does it need access to 18 sites?
- Because the panel has to appear on the coin page of each supported terminal. Host permissions are generated from the same table that lists the terminals on this site — nothing else is in the list, and the extension never loads remote code.
- What data does it store?
- Your Fullport session token and panel preferences (presets, slippage, unit), locally in extension storage. No browsing history, no wallet addresses, no clipboard.