diff --git a/.github/workflows/appium-mobile-tests.yml b/.github/workflows/appium-mobile-tests.yml
index 497fbbf6..7a564e0e 100644
--- a/.github/workflows/appium-mobile-tests.yml
+++ b/.github/workflows/appium-mobile-tests.yml
@@ -34,6 +34,9 @@ env:
   ALLURE_ENDPOINT: https://pezkuwi.testops.cloud/
   ALLURE_PROJECT_ID: 103
 
+permissions:
+  contents: read
+
 jobs:
   trigger-tests:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/balances_test.yml b/.github/workflows/balances_test.yml
index 9b5f57d4..02059794 100644
--- a/.github/workflows/balances_test.yml
+++ b/.github/workflows/balances_test.yml
@@ -6,6 +6,9 @@ on:
   schedule:
     - cron: '0 */8 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   build-app:
     uses: pezkuwichain/pezkuwi-wallet-android/.github/workflows/android_build.yml@main
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index 8f96d1b1..3d52bc09 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -29,6 +29,9 @@ env:
   DEBUG_GOOGLE_OAUTH_ID: ${{ secrets.DEBUG_GOOGLE_OAUTH_ID }}
   RELEASE_GOOGLE_OAUTH_ID: ${{ secrets.RELEASE_GOOGLE_OAUTH_ID }}
 
+permissions:
+  contents: read
+
 jobs:
   ktlint:
     name: Kotlin Lint
diff --git a/.github/workflows/distribute_app_to_play_store.yml b/.github/workflows/distribute_app_to_play_store.yml
index f1c9545c..b246d853 100644
--- a/.github/workflows/distribute_app_to_play_store.yml
+++ b/.github/workflows/distribute_app_to_play_store.yml
@@ -35,6 +35,9 @@ on:
         default: '0.2'
         type: string
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: pezkuwichain/pezkuwi-wallet-android/.github/workflows/android_build.yml@main
diff --git a/.github/workflows/install/action.yml b/.github/workflows/install/action.yml
index d674561e..219ebae6 100644
--- a/.github/workflows/install/action.yml
+++ b/.github/workflows/install/action.yml
@@ -14,6 +14,9 @@ runs:
       uses: android-actions/setup-android@v3
       with:
         cmdline-tools-version: 12266719
+        # The action's default also installs the legacy 'tools' package, which the current
+        # SDK repository no longer serves ("Failed to find package 'tools'"), failing the step.
+        packages: 'platform-tools'
 
     - name: Install NDK
       run: |
diff --git a/.github/workflows/manual_firebase_distribution.yml b/.github/workflows/manual_firebase_distribution.yml
index 5de73858..e5f39cc9 100644
--- a/.github/workflows/manual_firebase_distribution.yml
+++ b/.github/workflows/manual_firebase_distribution.yml
@@ -20,6 +20,9 @@ on:
         required: true
         default: main
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: pezkuwichain/pezkuwi-wallet-android/.github/workflows/android_build.yml@main
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 1e9a1a8c..c0232689 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -11,6 +11,9 @@ on:
         type: string
 
 
+permissions:
+  contents: read
+
 jobs:
   test:
     uses: pezkuwichain/pezkuwi-wallet-android/.github/workflows/android_build.yml@main
diff --git a/.github/workflows/push_develop.yml b/.github/workflows/push_develop.yml
index 7aa5ff80..912981b9 100644
--- a/.github/workflows/push_develop.yml
+++ b/.github/workflows/push_develop.yml
@@ -5,6 +5,9 @@ on:
     branches: [main]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     uses: pezkuwichain/pezkuwi-wallet-android/.github/workflows/android_build.yml@main
diff --git a/bindings/hydra-dx-math/rust/Cargo.lock b/bindings/hydra-dx-math/rust/Cargo.lock
index 5115e388..aa361ee7 100644
--- a/bindings/hydra-dx-math/rust/Cargo.lock
+++ b/bindings/hydra-dx-math/rust/Cargo.lock
@@ -372,9 +372,9 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.10.1"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "cc"
@@ -541,9 +541,9 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.4.0"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
+checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 dependencies = [
  "powerfmt",
 ]
@@ -1211,9 +1211,9 @@ dependencies = [
 
 [[package]]
 name = "keccak"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecc2af9a1119c51f12a14607e783cb977bde58bc069ff0c3da1095e635d70654"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
 dependencies = [
  "cpufeatures",
 ]
@@ -1294,11 +1294,11 @@ checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
 
 [[package]]
 name = "matchers"
-version = "0.1.0"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
 dependencies = [
- "regex-automata 0.1.10",
+ "regex-automata",
 ]
 
 [[package]]
@@ -1321,12 +1321,11 @@ dependencies = [
 
 [[package]]
 name = "nu-ansi-term"
-version = "0.46.0"
+version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "overload",
- "winapi",
+ "windows-sys",
 ]
 
 [[package]]
@@ -1341,9 +1340,9 @@ dependencies = [
 
 [[package]]
 name = "num-conv"
-version = "0.1.0"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-format"
@@ -1404,12 +1403,6 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "overload"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
-
 [[package]]
 name = "parity-bip39"
 version = "2.0.1"
@@ -1643,9 +1636,9 @@ checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "libc",
  "rand_chacha",
@@ -1708,17 +1701,8 @@ checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.4.9",
- "regex-syntax 0.8.5",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
-dependencies = [
- "regex-syntax 0.6.29",
+ "regex-automata",
+ "regex-syntax",
 ]
 
 [[package]]
@@ -1729,15 +1713,9 @@ checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-syntax 0.8.5",
+ "regex-syntax",
 ]
 
-[[package]]
-name = "regex-syntax"
-version = "0.6.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
-
 [[package]]
 name = "regex-syntax"
 version = "0.8.5"
@@ -1891,10 +1869,11 @@ checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
 
 [[package]]
 name = "serde"
-version = "1.0.219"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
+ "serde_core",
  "serde_derive",
 ]
 
@@ -1930,14 +1909,23 @@ dependencies = [
 ]
 
 [[package]]
-name = "serde_derive"
-version = "1.0.219"
+name = "serde_core"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.106",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -2277,6 +2265,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "tap"
 version = "1.0.1"
@@ -2323,30 +2322,30 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.41"
+version = "0.3.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a7619e19bc266e0f9c5e6686659d394bc57973859340060a69221e57dbc0c40"
+checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
 dependencies = [
  "deranged",
  "itoa",
  "num-conv",
  "powerfmt",
- "serde",
+ "serde_core",
  "time-core",
  "time-macros",
 ]
 
 [[package]]
 name = "time-core"
-version = "0.1.4"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9e9a38711f559d9e3ce1cdb06dd7c5b8ea546bc90052da6d06bb76da74bb07c"
+checksum = "7694e1cfe791f8d31026952abf09c69ca6f6fa4e1a1229e18988f06a04a12dca"
 
 [[package]]
 name = "time-macros"
-version = "0.2.22"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3526739392ec93fd8b359c8e98514cb3e8e021beb4e5f597b00a0221f8ed8a49"
+checksum = "2e70e4c5a0e0a8a4823ad65dfe1a6930e4f4d756dcd9dd7939022b5e8c501215"
 dependencies = [
  "num-conv",
  "time-core",
@@ -2453,14 +2452,14 @@ dependencies = [
 
 [[package]]
 name = "tracing-subscriber"
-version = "0.3.19"
+version = "0.3.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008"
+checksum = "2054a14f5307d601f88daf0553e1cbf472acc4f2c51afab632431cdcd72124d5"
 dependencies = [
  "matchers",
  "nu-ansi-term",
  "once_cell",
- "regex",
+ "regex-automata",
  "sharded-slab",
  "smallvec",
  "thread_local",
diff --git a/bindings/metadata_shortener/rust/Cargo.lock b/bindings/metadata_shortener/rust/Cargo.lock
index d4e1b9b2..149135aa 100644
--- a/bindings/metadata_shortener/rust/Cargo.lock
+++ b/bindings/metadata_shortener/rust/Cargo.lock
@@ -1,6 +1,6 @@
 # This file is automatically @generated by Cargo.
 # It is not intended for manual editing.
-version = 3
+version = 4
 
 [[package]]
 name = "array-bytes"
@@ -53,9 +53,9 @@ checksum = "c3ac9f8b63eca6fd385229b3675f6cc0dc5c8a5c8a54a59d4f52ffd670d87b0c"
 
 [[package]]
 name = "bytes"
-version = "1.6.0"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "514de17de45fdb8dc022b1a7975556c53c86f9f0aa5f534b98977b171857c2c9"
+checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "cc"
diff --git a/bindings/sr25519-bizinikiwi/rust/Cargo.lock b/bindings/sr25519-bizinikiwi/rust/Cargo.lock
index 0285c4a2..e3670207 100644
--- a/bindings/sr25519-bizinikiwi/rust/Cargo.lock
+++ b/bindings/sr25519-bizinikiwi/rust/Cargo.lock
@@ -185,9 +185,9 @@ checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
 
 [[package]]
 name = "keccak"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecc2af9a1119c51f12a14607e783cb977bde58bc069ff0c3da1095e635d70654"
+checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
 dependencies = [
  "cpufeatures",
 ]
@@ -251,9 +251,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "libc",
  "rand_chacha",
diff --git a/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/metamask/transport/MetamaskResponder.kt b/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/metamask/transport/MetamaskResponder.kt
index 709292ae..b966985d 100644
--- a/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/metamask/transport/MetamaskResponder.kt
+++ b/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/metamask/transport/MetamaskResponder.kt
@@ -4,8 +4,12 @@ import android.util.Log
 import io.novafoundation.nova.common.utils.LOG_TAG
 import io.novafoundation.nova.feature_dapp_impl.web3.webview.WebViewHolder
 import io.novafoundation.nova.runtime.multiNetwork.chain.model.ChainId
+import org.json.JSONObject
 
-sealed class MetamaskError(val errorCode: Int, message: String) : Throwable(message) {
+/**
+ * [publicMessage] is sent to the dApp page as is, so it must never carry internal error details.
+ */
+sealed class MetamaskError(val errorCode: Int, val publicMessage: String) : Throwable(publicMessage) {
 
     class Rejected : MetamaskError(4001, "Action rejected")
 
@@ -33,7 +37,8 @@ class MetamaskResponder(private val webViewHolder: WebViewHolder) {
     }
 
     fun respondError(messageId: String, error: MetamaskError) {
-        val js = "window.ethereum.sendRpcError($messageId, ${error.errorCode}, \"${error.message}\")"
+        val message = JSONObject.quote(error.publicMessage)
+        val js = "window.ethereum.sendRpcError($messageId, ${error.errorCode}, $message)"
 
         evaluateJs(js)
     }
diff --git a/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/polkadotJs/PolkadotJsResponder.kt b/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/polkadotJs/PolkadotJsResponder.kt
index 38ed5396..b9226b66 100644
--- a/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/polkadotJs/PolkadotJsResponder.kt
+++ b/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/polkadotJs/PolkadotJsResponder.kt
@@ -3,7 +3,9 @@ package io.novafoundation.nova.feature_dapp_impl.web3.polkadotJs
 import android.util.Log
 import io.novafoundation.nova.common.utils.LOG_TAG
 import io.novafoundation.nova.feature_dapp_impl.web3.Web3Responder
+import io.novafoundation.nova.feature_dapp_impl.web3.states.Web3StateMachineHost
 import io.novafoundation.nova.feature_dapp_impl.web3.webview.WebViewHolder
+import org.json.JSONObject
 
 class PolkadotJsResponder(
     private val webViewHolder: WebViewHolder
@@ -35,5 +37,20 @@ class PolkadotJsResponder(
 
     private fun successSubscription(id: String, result: String) = "window.walletExtension.onAppSubscription(\"$id\", $result)"
 
-    private fun failure(id: String, error: Throwable) = "window.walletExtension.onAppResponse(\"$id\", null, new Error(\"${error.message.orEmpty()}\"))"
+    private fun failure(id: String, error: Throwable): String {
+        val message = JSONObject.quote(publicErrorMessage(error))
+
+        return "window.walletExtension.onAppResponse(\"$id\", null, new Error($message))"
+    }
+
+    /**
+     * The page is untrusted, so it only ever receives a fixed message per known rejection reason,
+     * never the text of an arbitrary internal exception.
+     */
+    private fun publicErrorMessage(error: Throwable): String = when (error) {
+        Web3StateMachineHost.NotAuthorizedException -> "Rejected by user"
+        Web3StateMachineHost.SigningFailedException -> "Signing failed"
+        Web3StateMachineHost.PhishingDetectedException -> "Phishing detected!"
+        else -> "Request failed"
+    }
 }
diff --git a/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/polkadotJs/states/PhishingDetectedPolkadotJsState.kt b/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/polkadotJs/states/PhishingDetectedPolkadotJsState.kt
index bd5bcaed..a81c37aa 100644
--- a/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/polkadotJs/states/PhishingDetectedPolkadotJsState.kt
+++ b/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/polkadotJs/states/PhishingDetectedPolkadotJsState.kt
@@ -2,10 +2,11 @@ package io.novafoundation.nova.feature_dapp_impl.web3.polkadotJs.states
 
 import io.novafoundation.nova.feature_dapp_impl.web3.polkadotJs.PolkadotJsTransportRequest
 import io.novafoundation.nova.feature_dapp_impl.web3.states.PhishingDetectedState
+import io.novafoundation.nova.feature_dapp_impl.web3.states.Web3StateMachineHost
 
 class PhishingDetectedPolkadotJsState : PhishingDetectedState<PolkadotJsTransportRequest<*>, PolkadotJsState>(), PolkadotJsState {
 
     override fun rejectError(): Throwable {
-        return IllegalAccessException("Phishing detected!")
+        return Web3StateMachineHost.PhishingDetectedException
     }
 }
diff --git a/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/states/Web3ExtensionStateMachine.kt b/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/states/Web3ExtensionStateMachine.kt
index bd68f700..05b054cb 100644
--- a/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/states/Web3ExtensionStateMachine.kt
+++ b/feature-dapp-impl/src/main/java/io/novafoundation/nova/feature_dapp_impl/web3/states/Web3ExtensionStateMachine.kt
@@ -42,6 +42,7 @@ interface Web3StateMachineHost {
 
     object NotAuthorizedException : Exception("Rejected by user")
     object SigningFailedException : Exception("Signing failed")
+    object PhishingDetectedException : Exception("Phishing detected!")
 
     val selectedAccount: Flow<MetaAccount>
     val currentPageAnalyzed: Flow<BrowserPageAnalyzed>