Security starts with saying what exists.

Unit tests exercise recognized and unsupported parser paths, fee allocation normalization, validation conflicts, Behavior Score rule coverage, browser-storage shape guards, deterministic trade arithmetic, and isolation of internal fixtures from public genesis.

The production nginx configuration adds HTTPS redirection, HSTS, MIME sniffing protection, same-origin framing, a strict-origin referrer policy, and disables camera, microphone, and geolocation through Permissions Policy. Those headers reduce specific web risks; they do not make the application or future contracts secure by default.

No contract source exists in this repository, so there is no bytecode, deployment address, admin model, upgrade policy, custody path, access control, invariant suite, audit scope, or chain-specific risk to verify. Wallet connection, real trading, staking, and indexing are disabled.

There is also no documented bug bounty, private vulnerability inbox, disclosure policy, or response SLA.

A future execution layer would require a new threat model and security program: contract-level invariants, callback/reentrancy analysis, delta settlement checks, custody and routing review, access and oracle assumptions, deployment provenance, tests against adversarial pools/tokens, independent audits, and a responsible disclosure channel.

The only configured official contact is @justypedotfun on X. Because it is a public social channel, request an appropriate private reporting path before sharing sensitive exploit details. No response time is promised.

Never send a seed phrase, private key, password, or funds. For support scope, read Support.