alchemy-security-basics

# Alchemy Security Basics ## Overview Web3 security practices for Alchemy-powered applications: API key protection, private key management, input validation, and smart contract interaction safety. ## Security Checklist | Category | Requirement | Priority | |----------|------------|----------| | API keys | Never expose in client-side code | Critical | | Private keys | Use environment vars or secret manager | Critical | | Addresses | Validate and checksum all inputs | High | | RPC calls | Never pass user input directly to RPC | High | | Webhooks | Verify HMAC signatures | High | | Dependencies | Audit npm packages for supply chain | Medium | ## Instructions ### Step 1: API Key Protection ```typescript // WRONG — API key in frontend code // const alchemy = new Alchemy({ apiKey: 'demo123' }); // NEVER DO THIS // RIGHT — API key in backend proxy // src/api/proxy.ts import express from 'express'; import { Alchemy, Network } from 'alchemy-sdk'; const app = express(); const alchemy = new Alchemy({ apiKey: process.env.ALCHEMY_API_KEY, // Server-side only network: Network.ETH_MAINNET, }); // Proxy endpoint — frontend calls this instead of Alchemy directly app.get('/api/balance/:address', async (req, res) => { const { address } = req.params; if (!/^0x[a-fA-F0-9]{40}$/.test(address)) { return res.status(400).json({ error: 'Invalid address format' }); } const balance = await alchemy.core.getBalance(address); res.json({ balance: balance.toString() }); }); // Al...