Security Policies allow SA users to enforce arbitrary restrictions on which modules can be installed on their SAs. The checks are implemented as on-chain contracts called “Security Policies”, which can be individually enabled by SAs.

Once enabled, any module installed on the SA must satisfy all enabled Security Policies. Security Policies can also leverage a Module Registry and use the data stored in attestations to verify conditions on the modules to be installed.

Zellic conducted a security assessment for Biconomy from November 21st to November 24th, 2023. During this engagement, Zellic reviewed Security Policy's code for security vulnerabilities, design issues, and general weaknesses in security posture.