Site audit

Transport and browser hardening headers

HSTS (2 years, subdomains), X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy are all set. HTTP redirects to HTTPS with a 301.

Wallet auth is per-request signatures

Chat and key management require a message signed by the wallet with a timestamp, valid for ten minutes. There is no session cookie to steal and no address is trusted from a request body.

API keys stored as SHA-256 only

The plaintext key is shown once at mint and never persisted. Revocation is immediate and keeps the spend record.

RPC proxy uses a method allowlist

The browser reaches the chain through a server-side proxy that only forwards read methods and raw transaction broadcast. Upstream RPC URL is not exposed.

Database access is parameterised

All queries go through an ORM with bound parameters. No string-built SQL anywhere in the codebase.

Launch records are read from chain, not from the client

Recording a launch requires a mined transaction hash; token, curve, deployer, fee recipient and tax are decoded from the factory event and contracts. Only the model id comes from the client, and it is checked against the live catalogue.

Rate limits and a daily spend cap on inference

Fixed in v0.2. Chat is limited per wallet per minute and the OpenAI-compatible endpoint per key per minute, both answering 429 with a retry-after. On top of that each wallet has a rolling 24 h spend cap across chat and all its keys, read from the ledger so it survives restarts. All three are operator-configurable.

No Content-Security-Policy

Scripts, styles and images are not restricted by CSP. A stored-XSS bug elsewhere would have nothing holding it back. Third-party script surface today is only the wallet SDK.

FixShip a nonce-based CSP that allows self, the wallet SDK origins and the icon/IPFS image hosts.

Operator endpoints rely on a single bearer secret

Keeper, indexer and pool adjustments are gated by one static secret. Rotation is manual and there is no audit log of who used it.

FixMove to per-purpose secrets, log every operator call with a timestamp, rotate on a schedule.

Shared-pool spending model

By design an API key spends everyone's compute, not a personal balance. The daily cap per wallet now bounds how much one careless key holder can affect the rest.

FixA visible per-key spend page.

X-Powered-By header removed

The framework is no longer disclosed in a response header.

Underlying launch protocol is unaudited

Tokens, curves and graduation run on a third-party protocol that has not completed a public audit. This is stated on the docs page and applies to every launch.

Home and Markets render from a cached snapshot

Fixed in v0.2. The launch table is built once every 15 s (curve multicall, pool quotes, 24 h volume) and served stale-while-revalidate, so a request never waits on the chain. The ETH rate and catalogue were already cached.

About 610–650 KB of gzipped JavaScript on every page

The wallet SDK is loaded in the root layout, so the docs and models pages carry the same bundle as the launch page.

FixLoad the wallet provider lazily on pages that need it, or split the connect button into a client island that imports the SDK on first interaction.

Launch list API serves the same snapshot

Fixed in v0.2. /api/launches reads the cached snapshot and sets Cache-Control: s-maxage=15, stale-while-revalidate=60.

Secondary pages answer in under 0.4 s

Docs, launch form, keys, chat and token pages have a TTFB of 0.27–0.37 s.

Fonts are self-hosted at build time

No runtime request to a font CDN. Two families, latin subset only.

Provider logos come from a third-party icon service

Small images, lazy-loaded, with an initials fallback if they fail. A dependency on an external host nonetheless.

FixBundle the handful of provider marks locally.

Title, description, Open Graph and Twitter card

Present on every page with a 1200×630 preview image. Tab titles are the wordmark plus the page name.

robots.txt and dynamic sitemap

API routes are disallowed; every token page is listed in the sitemap with its creation date.

No canonical link

The site is reachable on two hostnames (the custom domain and the platform-issued one). Search engines may index both.

FixEmit a canonical link pointing at the custom domain and redirect the platform hostname.

Token pages share one description

Every token page uses the site-wide description. A per-token line (name, model, market cap) would preview better in chats.

FixGenerate description and OG image per token.

Reduced-motion is respected

The hero animation and travelling marker are disabled when the visitor's system asks for less motion.

Icon-only links carry labels

The X link and the logo have accessible names.

Some state is conveyed by colour alone

Graduation progress bars and the selected model row rely on colour; the ‘selected’ text helps on the launch form but the table bar has no text alternative beyond the percentage.

FixAdd `aria-valuenow` to progress bars and a visually hidden label.

No skip-to-content link

Keyboard users tab through the header on every page.

FixAdd a skip link as the first focusable element.

Small mono labels at 11 px

Uppercase mono labels are 11 px. Legible on desktop, tight on small phones.

FixRaise to 12 px below 640 px.

Keeper is not running on a schedule

Fees accrue on each curve but are only moved into the pool when the keeper runs. Until it is scheduled, ‘compute raised’ does not grow from trading.

FixSchedule the keeper every 10 minutes with a funded operator wallet.

Trade indexer is optional now

Trade history and 24 h volume are read straight from curve logs on request and cached briefly, so they no longer depend on the indexer. The indexer remains for a durable trade archive.

FixSchedule it when a full archive is wanted.

Provider top-up is manual

The pool is the platform's accounting of fees claimed, not a live reading of the inference provider's balance. If the two drift, calls fail at the provider. Documented on the docs page.

FixAlert when the provider balance falls below the pool's available figure.

No automated tests or CI

Type checking and linting run locally and pass; there is no test suite and no pipeline gating deploys.

FixAdd unit tests for the billing maths and pool ledger, and an integration test for launch recording against a forked chain.

No error tracking or uptime monitoring

Failures are visible only in host logs.

FixAdd an error tracker and an external uptime check on /api/pool.

Single operator wallet

Treasury and keeper are the same key by protocol design. Loss of that key stops fee collection (funds stay on chain).

FixKeep the key in a hardware or KMS-backed signer and document recovery.

Pool balance is a ledger sum

Available compute is always Σ credits − Σ debits over integer micro-dollars. No stored total to drift.

Every charge is checkable

Prompt and completion token counts are stored on the message and the ledger row, so any debit can be recomputed from the catalogue price.

Graduated tokens are priced from the pool

Fixed in v0.2. Once a curve sells out, price, market cap, 24 h volume and trade count come from the DEX pool via DexScreener, labelled ‘pool’ on the token page with a link to the pair.

Only ETH-paired launches are priced in USD

The platform creates ETH-paired tokens only. Third-party launches on the same factory with a different pair are recorded but not priced, to avoid a wrong number.