Security

Where things stand, and how to reach us if you find something. Short, because there is not much to claim.

• No external audit. 613 Solidity tests, kept in packages apart from the source so they cannot move the bytecode, and 564 indexer tests exist. Nobody independent has reviewed the contracts, the deployment or this front end.
• No bug bounty yet. This page will say so when there is one.
• Nothing is upgradeable. A bug in a deployed contract cannot be patched. What the owner can do is close launching with setLaunchEnabled, which stops new tokens from being created there; tokens already launched keep trading on the contracts they have.
• The front end is the softest target. The page your wallet signs from decides which address gets your transaction. Every script this site runs is served from its own domain and every address it prints comes from one file, config.js; check the address your wallet shows against Addresses before you sign.

Reporting

Send a direct message on X or Telegram; there is no email. The same contact details, machine-readable, are at /.well-known/security.txt. Please give us time to respond before publishing.