> ## Documentation Index
> Fetch the complete documentation index at: https://yieldxyz.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Security deployment options

> Combine client-side Shield, server-side Defense Mode, and the standalone binary to match your integration's security posture.

Shield's protection scales with how many of its enforcement points you run, not with a separate product tier. Every option below is the same validation engine, run in a different place; combine them to match your integration's deployment model.

## Enforcement points

| Option | Where it runs | What it adds |
| - | - | - |
| **Server-side (Defense Mode)** | Inside the Yield API's transaction pipeline | Runs inside the API in Monitor mode (validate and log) by default; in Block mode, transactions that fail validation are rejected before they're returned. See [Defense Mode](/documentation/platform/shield/defense-mode). |
| **Client-side, TypeScript library** | In your Node.js or browser process, after you receive a transaction | A second, independent check before signing; catches anything altered in transit or by a compromised intermediate layer. See [Shield integration](/documentation/platform/shield/integration). |
| **Client-side, standalone binary** | Any language, any environment, including restricted or air-gapped hosts | The same validation logic with no Node.js dependency and no network calls, since the vault registry is embedded in the binary. |

Running server-side Defense Mode plus a client-side check (library or binary) gives you two independent checkpoints: one inside the API, one in your own signing flow. Defense Mode needs no code changes on your end; a client-side check adds protection against tampering after the API responds.

## Choosing a client-side option

<Tabs>
  <Tab title="TypeScript / Node.js">
    Use the `@yieldxyz/shield` npm package directly in a Node.js backend, a server-side rendering layer, or a browser bundle. This is the simplest path for wallets, web apps, and hosted widget integrations.
  </Tab>

  <Tab title="Any other language">
    Use the standalone binary via its JSON-over-stdin/stdout protocol from Go, Python, Rust, or any language that can spawn a subprocess. This is the path for exchanges, custodians, and backends not written in TypeScript.
  </Tab>

  <Tab title="Restricted or air-gapped">
    Because the binary is self-contained and validates fully locally, it can run inside compiled backends, locked-down hosts, or air-gapped signing environments with no outbound network access.
  </Tab>
</Tabs>

<Note>
  For dedicated on-premises deployments or custom policy control beyond the standalone binary, contact the [yield.xyz team](mailto:hello@yield.xyz) to scope the setup.
</Note>

## HyperNative

Some integrations also run [HyperNative](/documentation/platform/shield/hypernative), a separate partner integration for pre-signing simulation, alongside Shield. Shield and HyperNative check different things: Shield validates that a transaction matches an expected structural pattern, HyperNative simulates what the transaction would do. They're independent layers, not tiers of the same product.

## Next steps

<CardGroup cols={2}>
  <Card title="Defense Mode" icon="shield-halved" href="/documentation/platform/shield/defense-mode">
    Server-side enforcement, rollout, and rollback
  </Card>

  <Card title="Shield integration" icon="plug" href="/documentation/platform/shield/integration">
    Library, standalone binary, and language guides
  </Card>

  <Card title="HyperNative" icon="bolt" href="/documentation/platform/shield/hypernative">
    Pre-signing simulation, as a separate partner integration
  </Card>

  <Card title="Security overview" icon="shield" href="/documentation/security/overview">
    How every piece fits together
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.