Site audit

Transport and browser hardening headers

HSTS (2 years, subdomains), X-Frame-Options DENY, X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy are all set. HTTP redirects to HTTPS with a 301.

Wallet auth is per-request signatures

Chat and key management require a message signed by the wallet with a timestamp, valid for ten minutes. There is no session cookie to steal and no address is trusted from a request body.

API keys stored as SHA-256 only

The plaintext key is shown once at mint and never persisted. Revocation is immediate and keeps the spend record.

RPC proxy uses a method allowlist

The browser reaches the chain through a server-side proxy that only forwards read methods and raw transaction broadcast. Upstream RPC URL is not exposed.

Database access is parameterised

All queries go through an ORM with bound parameters. No string-built SQL anywhere in the codebase.

Launch records are read from chain, not from the client

Recording a launch requires a mined transaction hash; token, curve, deployer, fee recipient and tax are decoded from the factory event and contracts. Only the model id comes from the client, and it is checked against the live catalogue.

No rate limiting on inference endpoints

Chat and the OpenAI-compatible endpoint have no per-wallet or per-key request limit. The only ceiling is 4,096 tokens per request and the pool balance itself. A leaked key or a hostile launcher could drain the shared pool quickly.

FixAdd a sliding-window limit per key and per wallet, plus a daily spend cap per key with an operator override.

No Content-Security-Policy

Scripts, styles and images are not restricted by CSP. A stored-XSS bug elsewhere would have nothing holding it back. Third-party script surface today is only the wallet SDK.

FixShip a nonce-based CSP that allows self, the wallet SDK origins and the icon/IPFS image hosts.

Operator endpoints rely on a single bearer secret

Keeper, indexer and pool adjustments are gated by one static secret. Rotation is manual and there is no audit log of who used it.

FixMove to per-purpose secrets, log every operator call with a timestamp, rotate on a schedule.

Shared-pool spending model

By design an API key spends everyone's compute, not a personal balance. This is documented, but it means one careless key holder affects all users.

FixPer-key spend caps (see rate limiting) and a visible per-key spend page.

X-Powered-By header is present

The framework is disclosed in a response header. Harmless on its own, but unnecessary.

FixDisable the header in the framework config.

Underlying launch protocol is unaudited

Tokens, curves and graduation run on a third-party protocol that has not completed a public audit. This is stated on the docs page and applies to every launch.

Home and Markets time-to-first-byte of 1.5–1.9 s

Both pages fetch the ETH/USD rate, the model catalogue and a multicall to every launch's curve before rendering. Each one is a network round trip on the request path.

FixCache the ETH rate and catalogue in memory with a short TTL (already partly done for the catalogue), and render the launch table from a cached snapshot refreshed every few seconds instead of on every request.

About 610–650 KB of gzipped JavaScript on every page

The wallet SDK is loaded in the root layout, so the docs and models pages carry the same bundle as the launch page.

FixLoad the wallet provider lazily on pages that need it, or split the connect button into a client island that imports the SDK on first interaction.

Launch list API responds in about 1.1 s

Same cause as the home page: live curve reads plus a price fetch per request.

FixServe from the same cached snapshot with a `Cache-Control: s-maxage` header.

Secondary pages answer in under 0.4 s

Docs, launch form, keys, chat and token pages have a TTFB of 0.27–0.37 s.

Fonts are self-hosted at build time

No runtime request to a font CDN. Two families, latin subset only.

Provider logos come from a third-party icon service

Small images, lazy-loaded, with an initials fallback if they fail. A dependency on an external host nonetheless.

FixBundle the handful of provider marks locally.

Title, description, Open Graph and Twitter card

Present on every page with a 1200×630 preview image. Tab titles are the wordmark plus the page name.

robots.txt and dynamic sitemap

API routes are disallowed; every token page is listed in the sitemap with its creation date.

No canonical link

The site is reachable on two hostnames (the custom domain and the platform-issued one). Search engines may index both.

FixEmit a canonical link pointing at the custom domain and redirect the platform hostname.

Token pages share one description

Every token page uses the site-wide description. A per-token line (name, model, market cap) would preview better in chats.

FixGenerate description and OG image per token.

Reduced-motion is respected

The hero animation and travelling marker are disabled when the visitor's system asks for less motion.

Icon-only links carry labels

The X link and the logo have accessible names.

Some state is conveyed by colour alone

Graduation progress bars and the selected model row rely on colour; the ‘selected’ text helps on the launch form but the table bar has no text alternative beyond the percentage.

FixAdd `aria-valuenow` to progress bars and a visually hidden label.

No skip-to-content link

Keyboard users tab through the header on every page.

FixAdd a skip link as the first focusable element.

Small mono labels at 11 px

Uppercase mono labels are 11 px. Legible on desktop, tight on small phones.

FixRaise to 12 px below 640 px.

Keeper is not running on a schedule

Fees accrue on each curve but are only moved into the pool when the keeper runs. Until it is scheduled, ‘compute raised’ does not grow from trading.

FixSchedule the keeper every 10 minutes with a funded operator wallet.

Trade indexer is not running on a schedule

Price and market cap are live from the curve, but trade history and 24 h volume depend on the indexer.

FixSchedule the indexer every 5 minutes.

Provider top-up is manual

The pool is the platform's accounting of fees claimed, not a live reading of the inference provider's balance. If the two drift, calls fail at the provider. Documented on the docs page.

FixAlert when the provider balance falls below the pool's available figure.

No automated tests or CI

Type checking and linting run locally and pass; there is no test suite and no pipeline gating deploys.

FixAdd unit tests for the billing maths and pool ledger, and an integration test for launch recording against a forked chain.

No error tracking or uptime monitoring

Failures are visible only in host logs.

FixAdd an error tracker and an external uptime check on /api/pool.

Single operator wallet

Treasury and keeper are the same key by protocol design. Loss of that key stops fee collection (funds stay on chain).

FixKeep the key in a hardware or KMS-backed signer and document recovery.

Pool balance is a ledger sum

Available compute is always Σ credits − Σ debits over integer micro-dollars. No stored total to drift.

Every charge is checkable

Prompt and completion token counts are stored on the message and the ledger row, so any debit can be recomputed from the catalogue price.

Graduated tokens show no price

Once a curve sells out, price discovery moves to the DEX pool, which the site does not read yet. The token page shows a dash instead of a number.

FixRead the pool's spot price and show it with a ‘from pool’ label.

Only ETH-paired launches are priced in USD

The platform creates ETH-paired tokens only. Third-party launches on the same factory with a different pair are recorded but not priced, to avoid a wrong number.