Results can be incomplete
NODAL only sees what is in the HAR file. Traffic from WebSockets, service workers, browser extensions, other journeys, builds, browsers or regions is not covered. A clean report means “nothing found in this capture”, not “nothing leaks”.
Findings can be wrong
Heuristic matches can be false positives — a token contract looks like a wallet address. Host categories come from hostnames and can be wrong. Values that were hashed, encrypted or obfuscated can be missed.
HAR files are sensitive
A HAR file can contain cookies, auth tokens, API keys and personal data. Capture with test wallets and test accounts, store HAR files carefully and delete them when done. NODAL reads files only in your browser tab.
Exports can be sensitive
Exports are redacted by default. If you turn redaction off, the files contain full wallet values and URLs. Handle them as sensitive.
Early software
Trace Lab is a first build. HAR import is in development and has not been reviewed by outside engineers. Do not rely on it as a release gate yet.
Not a certification
NODAL does not issue privacy scores, “safe” badges or compliance statements, and its reports are not legal advice.
Planned features can be misread
Privacy CI and the Observed Data Manifest are planned, not built. When they exist, a passing check or a published manifest will mean only that no undeclared flow was observed in the scenarios that ran. It will not mean the app never leaks data, and it is not a certification or security guarantee. Named projects (MetaMask, Reown AppKit, WalletConnect, Playwright, GitHub Actions, Nym, anon-rpc) are compatibility targets, not partnerships or endorsements.
The wallet-flow example is synthetic
The example runs a real browser against a made-up dApp with local stand-in hosts and a test wallet that holds no keys. Its findings show how NODAL reports flows. They say nothing about MetaMask, Reown, WalletConnect or any other real service.
The token is planned, not live
$NODAL is planned, not deployed: no contract, no launch, no audit, no locks, no distributions. The tax, split, lock terms and buyback schedule may change, the revenue stream planned to fund buybacks and burns is still in development and nothing is bought back or burned, and the token may not launch. Nothing on this site promises price, returns or income. Trace Lab does not use or require a token. See $NODAL token and Revenue share.
Last updated: October 2026.