Workspace Security Hub

Most teams find out about a misconfiguration after it costs them something. A signer that was never removed. A threshold of one1 that nobody meant to keep. A module installed for a one-time task and never reviewed again. The information was always onchain. It was just never in one place.

The Workspace Security Hub puts it in one place. It runs 12 automated checks against your Safe's onchain configuration, deployment history, and operational state, then returns a single security strength score with a card for every check. Open it from any Safe, on every supported network. No setup, no integration, no new tool to learn.

The score is honest by design. It counts the checks that apply to your account and excludes the ones that don't. If any check is Critical, like a single signer or a blocklisted address, the score is capped no matter how clean everything else looks. A fundamentally insecure account never shows as strong.

Here is what it means for the people who carry the risk.

For security and risk leads

A security team's job is to find the exposure before someone else does.

Security Hub gives you a standing read on the account's attack surface. It screens every signer against sanctioned and malicious-address exposure, so a flagged or compromised key surfaces before it approves anything. It also verifies that every installed module and transaction guard is recognized, because an unverified module has full control over the Safe and can move funds without signer approval. It flags unrecognized fallback handlers, custom contract implementations, and deployments that did not come from an official Safe factory.

Every finding comes with a recommendation and a direct route to fix it. You get a posture you can monitor, not a report you have to commission. Security Hub gives your security team a list of what has actually been checked.

For treasury and finance operators

Treasury safety is a configuration problem before it is a market problem.

Security Hub gives you a standing view of whether your account is set up the way you think it is: the right signers, a threshold above a single approval, recovery in place so the account survives key loss, and a queue that isn't quietly filling with stale transactions that could execute against outdated intentions.

Recovery is checked in the same pass, so the account survives the loss of a key rather than depending on one.
For a treasury operator, this turns "the setup hasn't changed since we configured it" into an answer you can check before every transfer.

For protocol and governance teams

Governance accounts hold the most consequential permissions onchainand they often run across several networks.

Security Hub checks that your signer setup is consistent on every chain your Safe is deployed to, because a different signer set on one network can break approvals and put control at risk. It verifies your contract version against known official deployments, confirms recovery is configured, and reviews the modules and guards that touch execution.

For a security council, this turns "we think the setup is correct on all chains" into something you can read off a screen.

Built on the security model you already trust

Security Hub adds visibility, not custody. Your keys, your signers, and your signing rules are untouched. It reads your account and tells you where it stands. Nothing about how your Safe executes changes.

Access follows the Safe. Owners with a connected wallet can view it, and so can members of a Space that contains the account, so a security lead can review posture without holding a key.

Safe holds more than $60B in onchain assets across more than 25 networks, and the teams that rely on it include GnosisDAO, Aave, ENS, Worldcoin, and Mantle. The Workspace Security Hub is how every one of those accounts can now see its own security clearly, in one place, in real time.

Open the Security Hub from any Safe and read your score.

Safe{Wallet}

2 July 2026

Copy link