Open Source Cardano Wallet: How to Verify GeroWallet's Code

An open source Cardano wallet is one whose source code you can read, rather than one you simply have to trust. Since August 2026, GeroWallet's full wallet source code is public on GitHub at github.com/Gero-Labs/gerowallet, so anyone can inspect how keys are stored, how transactions are built, and what the extension sends over the network. It is released under the Apache 2.0 licence, which is OSI-approved open source rather than a look-but-do-not-touch arrangement. This guide explains what that does and, just as importantly, does not guarantee.

TL;DR

GeroWallet's complete browser-extension source is public at github.com/Gero-Labs/gerowallet under the Apache 2.0 licence, so you can read it, audit it, fork it and build on it, but not ship it under the Gero name. The repository is the shipped wallet, not a reference client, and it carries a security policy with a private disclosure route. Public code does not prove the build you installed matches the repository, and it does not replace the two external audit rounds the wallet went through before the code was opened. The six-point checklist near the end works on any Cardano wallet, not just this one.

Where GeroWallet fits: the wallet you can install from gerowallet.io is the same code you can read on GitHub, and the security page lists how it is hardened.

Why a wallet's source code is the only real proof

Every non-custodial wallet makes the same promise: your keys stay on your device, and nobody else can move your funds. When the code is closed, that promise is a marketing claim. You are trusting a company's word, a screenshot of an audit summary, and the app store review process.

When the code is public, the promise becomes checkable. A developer can open the repository and answer concrete questions:

Where does the private key actually live? Read the storage layer and see whether the key is encrypted at rest and what derives the encryption key.

What leaves the device? Search the network calls and see exactly which endpoints get contacted and what payload each one carries.

Does the extension ask for more browser permissions than it needs? The manifest file lists every permission in plain text.

None of that requires taking anyone's word for anything. That shift, from trust to verification, is the whole point.

Is GeroWallet open source?

The honest answer has two parts.

The source code is public. The complete wallet, a Vue and TypeScript Chrome extension built on Manifest V3, is published in the Gero-Labs/gerowallet repository. Anyone can read it, clone it, and audit it without asking permission or signing anything.

The licence is Apache 2.0. The code is published under Apache 2.0, copyright A.D. Labs. That is an OSI-approved open source licence: you get full read and audit rights, plus the right to fork, modify and redistribute within the licence terms, including an express patent grant.

This is worth being precise about, because "open source" is a claim wallets get called out for stretching. Plenty of projects publish code under a non-commercial or business-source licence and let the phrase do work it has not earned. Apache 2.0 is not one of those.

For someone who simply wants to verify that their wallet is safe, the part that matters is read access, and that has been there since the repository went public.

What is in the public repository

The repository is the actual shipped wallet, not a demo or a stripped-down reference version. Alongside the application code it carries the pieces that signal a repository is meant to be used rather than just displayed:

A security policy. SECURITY.md sets out a responsible vulnerability disclosure process, including an email fallback for researchers who would rather not open a public issue. A wallet with no disclosure route is a wallet that finds out about bugs from Twitter.

A code of conduct and contributing guide. CODE_OF_CONDUCT.md and CONTRIBUTING.md describe how to participate and what is expected.

Issue and pull request templates. Structured reports rather than one-line bug tickets.

Hardened continuous integration. The build workflows were tightened for public exposure, with guards on pull requests coming from forks and GitHub Actions pinned to specific commit hashes rather than floating tags. Unpinned actions are a well-known supply chain weak point, and pinning them is the boring correct fix.

How to verify the code yourself

You do not need to be a Cardano developer to get value out of the repository. Here is a realistic path, from lightest to deepest.

Start with the README and SECURITY.md. Five minutes. They tell you the shape of the project and how the team handles reported bugs.

Read the extension manifest. Search the repository for manifest.json. The permissions array is the complete list of browser capabilities the extension requests. Compare it against what a wallet plausibly needs.

Follow the key handling. Search the codebase for terms like mnemonic, encrypt, and Argon2. You are looking for whether secrets are encrypted before they touch storage and how strong the key derivation is. GeroWallet 2.7, released in August 2026, moved mnemonic, two-factor and MPC encryption to Argon2id, a memory-hard function chosen specifically to make brute-force attacks expensive. The wallet security post walks through that change in detail.

Trace one transaction. Pick the send flow and follow it from the button click to the signed transaction. This is the deepest check and the one that actually proves a wallet is non-custodial, because you can see the signature being produced locally.

Watch the commit history. A repository that stops moving is a signal in itself. Active commits mean active maintenance. GeroWallet's repository went from the 2.7.0 release in August 2026 to 2.7.1 in September, and the compare view between the two tags shows every change in between.

If you find something wrong, use the disclosure process in SECURITY.md rather than posting it publicly. That is how researchers get issues fixed instead of exploited.

What publishing the code does not mean

Being able to read the code is valuable, and it is worth being precise about what it does not deliver.

It is not a guarantee of zero bugs. Public code has bugs. The difference is that public bugs can be found by people other than the team that wrote them. GeroWallet went through two external audit rounds plus an internal review before opening the repository, and that is a complement to public code, not a substitute for it.

It is not community governance. Publishing the source does not mean every pull request gets merged or that the roadmap is decided by vote. Product direction stays with the team.

It is not permission to use the Gero name. Apache 2.0 grants copyright and patent rights, not trademark rights. You can fork the code; you cannot ship it as GeroWallet.

It does not mean the extension you installed matches the repository. Reproducible builds are the hard version of this problem, and it is an honest limitation across almost the entire browser extension ecosystem. Reading the source tells you what the team wrote. It does not by itself prove byte-for-byte what the store served you.

What this changes for you

If you already run a Cardano wallet, the practical upgrade is that "is my wallet safe" becomes a question with an answer you can go and check, or hand to a developer friend to check for you.

If you are choosing between Cardano wallets, code transparency belongs on your list next to hardware wallet support and staking. GeroWallet supports Ledger, Trezor and Keystone, offers passkeys as an option on top of a spending password, and includes Cardano Shield scam detection and Xerberus risk ratings. You can now confirm how each of those is implemented rather than taking the feature list at face value.

You can read more about how the wallet is hardened on the GeroWallet security page, or see the full feature set at gerowallet.io/features.

A transparency checklist for any Cardano wallet

Use this on any wallet you are considering, not just this one. It takes about ten minutes per wallet and it filters out a surprising amount.

Can you find the repository at all? A wallet that describes itself as open source should link the repository from its own site. If the only reference is a blog post from two years ago, treat the claim as expired.

Is the published code the shipped product? Some projects publish an SDK, a website, or a stripped reference client and let the phrase "open source" do the rest. Check that the repository contains the actual application, including the key handling and the transaction builder.

What licence is it really under? Open the LICENSE file rather than trusting the badge. Source-available, business source and non-commercial licences are all legitimate choices, but none of them are OSI open source, and some projects blur that line. GeroWallet's LICENSE file reads Apache 2.0, and you should check it rather than take this article's word for it.

Is there a security policy? Look for SECURITY.md and a private reporting route. A project without one has no plan for the day a researcher finds something.

Has anything been committed recently? Open the commit history. Regular activity means someone is maintaining it. A repository frozen for a year is a published snapshot, not a living project.

Are the CI workflows sensible? If you are comfortable reading them, check whether third-party GitHub Actions are pinned to commit hashes and whether pull requests from forks can reach repository secrets. This is where supply chain attacks land.

A wallet that passes all six is not automatically the best wallet. It is a wallet that has done the unglamorous work, and that correlates well with the rest of the engineering.

Frequently asked questions

Is GeroWallet open source?

Yes. The full source code is public on GitHub under the Apache 2.0 licence, which is OSI-approved. You can read, clone, audit, fork and modify it within the licence terms. What Apache 2.0 does not hand over is the Gero trademark.

Where is the GeroWallet source code?

At github.com/Gero-Labs/gerowallet. It is the full Vue and TypeScript Chrome extension, published under Apache 2.0, copyright A.D. Labs.

Does public source code make a wallet safer?

It makes a wallet checkable, which is different from safe. Public code lets independent researchers find issues, and it lets you confirm the non-custodial claim yourself. It works best alongside external audits and a real disclosure policy, both of which GeroWallet has.

How do I report a vulnerability in GeroWallet?

Follow the responsible disclosure process in SECURITY.md in the repository. It includes an email fallback so researchers can report privately rather than opening a public issue.

Can I build GeroWallet from source and run my own version?

Yes. Apache 2.0 lets you clone, build, modify and redistribute, including commercially, provided you follow the licence terms such as retaining the notices and stating your changes. You would need to ship it under your own name rather than ours.

Try a Cardano wallet you can actually read

Transparency is only useful if the wallet is worth using in the first place. GeroWallet is a non-custodial Cardano browser extension with ADA staking, governance and DRep delegation, an integrated swap, an NFT gallery, cashback through Bring, and support for Ledger, Trezor and Keystone hardware wallets.

Install GeroWallet and then go read the code that runs it.