Add ecosystem wallet security documentation (#4911)

Signed-off-by: Ian Mukherjee <ian@thirdweb.com>
Signed-off-by: Joaquim Verges <joaquim.verges@gmail.com>
Co-authored-by: Joaquim Verges <joaquim.verges@gmail.com>

Author: ianthirdweb

apps/portal/src/app/connect/ecosystems/security/page.mdx

@@ -0,0 +1,52 @@
+import { DocImage, Callout, createMetadata } from "@doc";
+
+export const metadata = createMetadata({
+	image: {
+		title: "Ecosystem Wallet Security",
+		icon: "wallets",
+	},
+	title: "Ecosystem Wallet Security",
+	description:
+		"Learn how thirdweb protects your user's private keys across an ecosystem using nitro Enclaves",
+});
+
+# Ecosystem Wallet Security
+
+## Wallet Creation
+
+When a user signs into an application using their email or social logins for the first time, a wallet is generated within a secure enclave on the server after verifying the user's legitimacy. The enclave provides a trusted execution environment, ensuring the wallet creation process is isolated and protected from external interference.
+
+- The wallet and its corresponding private key are generated entirely within the enclave, never leaving its secure confines.
+- User authentication data is verified within the enclave, ensuring that only legitimate, authenticated users can initiate wallet creation.
+
+## Security Measures
+
+- The enclave's cryptographic properties ensure that even the server operators cannot access the contents or operations within the enclave.
+- The enclave provides a verifiable hash of the image of the code that is being run on the device, allowing anyone to verify the contents of the code.
+- The wallet's private key never exists in an unencrypted form outside of the enclave.
+- All sensitive operations, such as transaction signing, occur within the enclave, ensuring the wallet's security.
+
+## Wallet Usage
+
+### General Usage
+
+- When users interact with their wallet via the the enclave, all communications are encrypted and only the legitimate user can access their wallet.
+- All traffic is encrypted with TLS and HSTS. Services are run in private VPCs on AWS and accessible only from a single entry point via our Cloudflare DNS.
+- Applications can [link multiple authentication methods](/connect/in-app-wallet/guides/link-multiple-profiles) to the same enclave. Any of these methods can be used to authenticate into the users wallet.
+
+### Ecosystem Usage
+
+- Ecosystem wallets are controlled by the ecosystem owner.
+  - We moved away from the shamir secret sharing model and replaced it with Encalves. This ensures no-one can extract the private key from the client, including other developers in the ecosystem.
+  - With enclave and partner policies, ecosystem owners are able to place restrictions on what individual partners are able to do. Since the private key is never re-constructed on the client, the ecosystem partner must submit the request to the enclave which would be able to verify the request and block requests that are out of scope or denied by the ecosystem owner.
+
+## Recoverability
+
+- Users can export their private key at any time.
+- Thirdweb wallets support three categories of authentication: socials, custom authentication, and email / phone authentication. If a user ever loses access to their authentication method:
+
+  1.  **For socials and email / phone authentication,** users can utilize the recovery flow of their providers to regain access to their account.
+  2.  **In the case of custom authentication,** the developer managing their authentication flow will be able to re-instate the users account upon successful verification.
+  3.  Application providers **do not have direct access** to user accounts or private keys, as these remain secured within the enclave. The enclave's design ensures that only verified user requests can trigger wallet operations.
+
+- Users are able to link their authentication methods which will provide them multiple ways to access their account if they ever lose access to any one of their authentication method.

apps/portal/src/app/connect/in-app-wallet/guides/get-user-details/page.mdx

@@ -1,6 +1,6 @@
 import { Tabs, TabsList, TabsContent, TabsTrigger, DocImage } from "@doc";
 
-# Retrieving In-App Wallet User Details on the Server
+# Fetching User Details from the Server
 
 ## Using the thirdweb TypeScript SDK
 

apps/portal/src/app/connect/in-app-wallet/security/page.mdx

@@ -4,12 +4,12 @@ import { DocImage, Callout, createMetadata } from "@doc";
 
 export const metadata = createMetadata({
 	image: {
-		title: "How In-App Wallet works",
+		title: "In-App Wallet Security",
 		icon: "wallets",
 	},
-	title: "How In-App Wallet works",
+	title: "In-App Wallet Security",
 	description:
-		"When a user signs into an application using their email or social logins for the first time, a wallet is generated on the user's device. The corresponding wallet key for this wallet is securely split into three shards using Shamir's Secret Sharing algorithm",
+		"Learn how thirdweb protects your user's private keys using Shamir's Secret Sharing algorithm",
 });
 
 # How it works

apps/portal/src/app/connect/sidebar.tsx

@@ -225,10 +225,6 @@ export const sidebar: SideBar = {
                   name: "Retrieving Linked Profiles",
                   href: `${inAppSlug}/guides/retrieve-linked-profiles`,
                 },
-                {
-                  name: "Retrieving User Info",
-                  href: `${inAppSlug}/guides/get-user-details`,
-                },
               ],
             },
             {
@@ -261,6 +257,10 @@ export const sidebar: SideBar = {
                 },
               ],
             },
+            {
+              name: "Backend APIs",
+              href: `${inAppSlug}/guides/get-user-details`,
+            },
             {
               name: "FAQs",
               href: `${inAppSlug}/faqs`,
@@ -276,6 +276,10 @@ export const sidebar: SideBar = {
               name: "Overview",
               href: `${ecosystemSlug}/overview`,
             },
+            {
+              name: "Security",
+              href: `${ecosystemSlug}/security`,
+            },
             {
               name: "Get Started",
               href: `${ecosystemSlug}/get-started`,