Dispute: "ukey-wallet" marked as potentially malicious and set to private

[ukey-wallet]

Hi Snap Store Reviewers,

I am the maintainer of the snap “ukey-wallet”.

Recently, we received an email notification that our snap was flagged as “potentially malicious” and changed to private status. We would like to politely dispute this flag, as “ukey-wallet” is a completely safe, fully decentralized (non-custodial) crypto wallet.

Here is some context regarding the nature of our application that might have triggered the automated scanner:

1. Fully Non-Custodial: All user private keys and seed phrases are generated and stored locally on the user’s device using industry-standard cryptography. We never upload or collect any sensitive user data.
2. Network Requests: The wallet needs to interact directly with decentralized blockchain RPC nodes to broadcast transactions and fetch balances, which may have flagged the network activity monitor.
3. Local Encryption: The application uses local system storage to keep encrypted wallet data, which may request standard storage plugs.

We have absolutely no malicious intent. We are fully willing to cooperate with the security team:

• If the snap requires any specific interface adjustments (plugs/slots), please let us know.
• If you need to audit our source code or reproducible build process, we are happy to provide it.

Could you please review our snap revision or provide detailed feedback on what specific content/behavior triggered the restriction?

Thank you for your time and help in keeping the ecosystem safe.

Best regards, [Ukey Wallet]

[store-requests-bot]

This request has not been added to the review queue. It should be placed in the appropriate store-requests subcategory using the subcategory template for classic-confinement, privileged-interfaces and aliases requests.

[leowangguan]

Hi @ukey-wallet

Thank you for reaching out. You will need to become a Verified Account in advance to publish legitimate crypto related snaps. You can follow the process below.

Verified Accounts

We wanted a way to demonstrate that a snap is being published and maintained by a trusted entity in the Snap Store. Verified Accounts have been created for this purpose. We grant Verified Account status to institutions, foundations or companies that have worked, collaborated or partnered with us, that prove to us that their snaps are maintained, genuine and of high quality. These publishers can apply to have Verified Account status and get a [image] by their name in the Snap Store. You’ll be ab…

BRs

Leo

[ukey-wallet]

@Verified Accounts

We wanted a way to demonstrate that a snap is being published and maintained by a trusted entity in the Snap Store. Verified Accounts have been created for this purpose. We grant Verified Account status to institutions, foundations or companies that have worked, collaborated or partnered with us, that prove to us that their snaps are maintained, genuine and of high quality. These publishers can apply to have Verified Account status and get a

by their name in the Snap Store. You’ll be able to see the green tick icon on all the snaps of that Verified Publisher, showing that the snaps are of high quality, coming from a dependable author. This policy explains what you need to do if you’d like to apply to be a Verified Publisher.

1. Start a new post in the forum, using the policy-requests category. In the post, state that you’d like to be a Verified Publisher with the following information:

• A list of the snaps that you have, that should have a verified publisher associated with them.
• The institution, foundation or company that you are a member of or work for.
• Your role within that institution, foundation or company.
• The group email address that should be tied to the Verified Account.
• The way in which your institution has worked, collaborated or partnered with us. If your institution, foundation or company hasn’t so far, let’s start a conversation.

2. Members of the @policy-reviewers group will review and add any comments they have. If there are any questions from the reviewers, they will start a discussion on the post.
3. If at least 2 members of the @policy-reviewers group review, leave their feedback and approve, then the account will become Verified. You will be a trusted publisher in the Store.
4. The snaps published by a Verified Account will be reviewed periodically to ensure that snaps are still being maintained. If there is any behaviour in the forum that is negative, inappropriate or not supportive of others, then we will open a discussion and may revoke the status.

Some key points to highlight:

• Verified Publisher status is for snap authors that have worked, collaborated or partnered with us as part of an institution, foundation or company. If you are an individual publisher that has maintained a number of snaps or been active in the community, you can apply to be a Star Developer here.
• The email address tied to a Verified Account must be a group - i.e. an email address that could be accessed by multiple developers responsible for the snap. This is to ensure that if an individual leaves that company, the snap can still be accessed and maintained by others in the organisation
• By being a Verified Publisher, you accept the responsibility and additional trust placed in you by others. You agree to deliver high-quality snaps and keep them updated and maintained.

Thank you for the clarification and for providing the Verified Publisher policy.

Our Snap developer account was registered using UKey Wallet’s legal company information, and our company details have already been submitted.

We understand that developer account registration is separate from Verified Publisher status. We will create a new post in the policy-requests category and provide our snap package details, company name, role, shared group email address, and relevant information about our relationship with Canonical and Snapcraft.

As we have not yet established a formal partnership with Canonical, we would appreciate guidance on how to start this conversation and satisfy the requirements for publishing a legitimate cryptocurrency wallet.

[leowangguan]

Hi,

Raising a request for verified accounts is the start of establishing partnership with Canonical . Please go ahead with creating that request and policy-reviewers (don’t forget to tag them in your request) will review it.

BRs

Leo