The answer
An xpub alone normally cannot sign transactions, but it can expose a whole account's addresses and balances.
What to do next
Treat xpubs as private metadata and revoke third-party access where possible.
Sparrow Bitcoin desktop wallet
This resource helps with the question, but is not presented as a commissionable partner.
Visit Sparrow Bitcoin desktop wallet ↗Useful research or product resource; no affiliate status assumed.RELATED PRODUCT OR SERVICE
Trezor hardware wallet
Related self-custody hardware; verify supported coins, networks and recovery standards. It cannot reverse an already compromised seed or fraudulent transfer.
Explore Trezor hardware wallet ↗Official website; affiliate programme available to apply for. No tracked link or partner approval yet.