No private keys on server
The PHP application has no contract-write endpoint and no configuration field for a wallet private key, mnemonic or Secret Recovery Phrase.
Security centre
The website must never become the wallet.
TNWT administrative authority remains on-chain and external to the web server. The portal is designed to verify state, help users identify the official contract and fail closed when critical configuration is wrong.
ChainVerifiedExpected Chain ID 56
Contract codePresentBytecode at official address
ADMIN_ROLEExpectedExpected wallet role
Master adminExpectedDEFAULT_ADMIN_ROLE
Minimal permissions
Wallet connection requests account access, BNB Smart Chain switching and optional TNWT token watching. It does not silently sign transactions.
Restrictive headers
CSP, HSTS on HTTPS, frame blocking, restrictive Permissions-Policy, secure sessions and dotfile/storage blocking reduce common web attack paths.
Read-only security console
The token admin dashboard monitors chain state and audit events. Any real contract administration should be explicitly approved in a wallet or multisig outside the server.
Role drift detection
The live service checks that the expected wallet still has ADMIN_ROLE and DEFAULT_ADMIN_ROLE and flags mismatches.
Segregation before launch
Separate operational, liquidity, community and reserve wallets reduce the consequences of one compromised key.
Travel Network World will never need your seed phrase. Anyone asking for a Secret Recovery Phrase or private key is not performing a legitimate TNWT support step.