alchemy-security-basics

name	alchemy-security-basics
description	Apply Web3 security best practices for Alchemy-powered applications. Use when securing API keys, validating blockchain inputs, preventing private key exposure, or hardening dApp infrastructure. Trigger: "alchemy security", "web3 security", "protect private key", "alchemy API key security", "dApp security".
allowed-tools	Read, Write, Edit, Grep
version	1.0.0
license	MIT
author	Jeremy Longshore <[e-mail]>
tags	["saas","blockchain","web3","alchemy","security"]
compatible-with	claude-code

Alchemy Security Basics

Overview

Web3 security practices for Alchemy-powered applications: API key protection, private key management, input validation, and smart contract interaction safety.

Security Checklist

Category	Requirement	Priority
API keys	Never expose in client-side code	Critical
Private keys	Use environment vars or secret manager	Critical
Addresses	Validate and checksum all inputs	High
RPC calls	Never pass user input directly to RPC	High
Webhooks	Verify HMAC signatures	High
Dependencies	Audit npm packages for supply chain	Medium

Instructions

Step 1: API Key Protection

// WRONG — API key in frontend code
// const alchemy = new Alchemy({ apiKey: 'demo123' }); // NEVER DO THIS

// RIGHT — API key in backend proxy
// src/api/proxy.ts
import express from 'express';
import { Alchemy, Network } from 'alchemy-sdk';

const app = express();
const alchemy = new Alchemy({
  apiKey: process.env.ALCHEMY_API_KEY, // Server-side only
  network: Network.ETH_MAINNET,
});

// Proxy endpoint — frontend calls this instead of Alchemy directly
app.get('/api/balance/:address',  (req, res) => {
   { address } = req.;
   (!.(address)) {
     res.().({ :  });
  }
   balance =  alchemy..(address);
  res.({ : balance.() });
});