Site audit

Review log

What the review of 22 September 2026 found, and what changed

Three passes: the HTTP layer, the application source and the launch path. Everything found is listed here, including the parts that were wrong in our favour. Entries are never removed.

1. Fixed

   A launch could put a script into its own links

   The X and website links of a launch were stored as free text and rendered straight into the href of the token page. A javascript: address would have run for everyone who opened that page.

   The launch endpoint accepts only http(s) URLs for the logo, X and website fields; the form checks them before the wallet signs, so no gas is spent on a launch the site would refuse; and the token page renders a link only when it starts with http(s), whatever the database holds.

2. Fixed

   The content security policy only covered framing

   The policy allowed everything except being embedded in another site. Scripts and styles could be loaded from any origin, and there was no Permissions-Policy.

   Scripts and styles are limited to this origin (inline still allowed, which Next itself needs), images may come from any HTTPS origin because token logos and provider icons live elsewhere, plugins are blocked, forms may only post here, and camera, microphone, geolocation, payment and USB are switched off.

3. Fixed

   Connecting a wallet asked a question it already knew the answer to

   Every click on Connect opened a picker, even when only one of the two supported wallets was installed, and the picker sniffed window objects that MetaMask and Phantom both spoof.

   The site asks each wagmi connector whether its provider exists. With exactly one wallet present the extension opens straight away; with two or none the picker appears, and install and mobile deep links open in a new tab.

4. Mitigated

   The treasury is not configured on this deployment yet

   The treasury address is the zero address until the operator sets it. A launch made in that state would name nobody as fee recipient and its 2% would be unreachable.

   The launch form refuses to submit while the treasury is unset and says why. Nothing can be launched from this site until the address and the keeper key are in place.

5. Open

   The root domain is not yet served

   www.useasemai.com is verified and certified. The bare domain has a CNAME at the zone apex, which the DNS standard forbids, so resolvers answer inconsistently and the certificate cannot be issued.

   Waiting on the DNS record to be replaced with an ALIAS. Until then the site is reachable on www and on its Railway domain.

Security

• Pass

  Access is a signature, not a session

  Every write carries a wallet address, a timestamp and a signature over them; signatures expire after ten minutes and there is no cookie or session to steal. Unauthenticated calls to /api/me, /api/launch and the persona and memory endpoints answer 401.

• Pass

  Only the deployer can register a launch

  The launch endpoint reads the factory record from chain, checks the curve, the fee recipient and the deployer against it, and rejects anything that does not match. A request body cannot claim a token it did not launch.

• Pass

  API keys are hashed

  Keys are stored as SHA-256 with a short prefix for recognition and shown once. Per-minute rate limits and daily caps in micro-USD bound what any key or wallet can spend from the pool.

• Pass

  Operator routes need a secret

  Cron, the pool adjustment and the offspring veto require CRON_SECRET; without it they answer 401. The keeper's private key lives only in the server environment and never reaches the browser.

• Pass

  Transport and browser hardening

  HSTS with preload, X-Frame-Options DENY, nosniff, a strict referrer policy, a content security policy and a permissions policy are set on every response.

• Partial

  Inline scripts are still allowed

  The policy permits inline scripts because the framework emits them. A nonce-based policy needs middleware and is the next step.

• Partial

  One key spends the treasury

  The keeper is a spender, not an owner: it can claim fees and launch offspring, it cannot mint or touch locked liquidity. But it is a single key. pons v2 itself has no third-party audit, and that is the largest open risk.

Performance

• Pass

  Server-rendered HTML

  Home, markets, token and docs pages render on the server. Time to first byte on the live deployment is about a quarter of a second and the home page is under 45 KB of HTML.

• Pass

  Cached catalogue, bounded RPC

  The model catalogue is cached in memory for ten minutes and in the database for an hour. Curve reads go through multicall with a timeout, and tables fall back to indexed numbers when the RPC is slow.

• Pass

  Self-hosted fonts, drawn graphics

  Instrument Sans and DM Mono are served from this origin with font-display swap. The hero chart, the background and the brand mark are code, not images.

• Partial

  Third-party icons

  Provider icons come from a favicon service. A cached copy per provider would remove the dependency.

SEO and sharing

• Pass

  Metadata

  Every page sets a title and inherits the site description from one brand config. The Open Graph image is generated in code with the brand's own font.

• Pass

  Per-token cards

  Each token page generates its own title and description from the launch and uses the token logo as its share image.

• Pass

  Sitemap and robots

  The sitemap lists every public page plus a page per listed token and is rebuilt on request; robots allows the site and keeps crawlers out of the API and MCP.

• Partial

  Canonical host

  Canonical URLs point at useasemai.com, which is not served yet. Until the root domain resolves, crawlers reach the site on www.

Accessibility

• Pass

  Reduced motion

  The hero chart draws its final frame and the background blobs stand still under prefers-reduced-motion.

• Pass

  Decorative graphics are hidden

  The chart, the rails, the brand mark and token logos carry aria-hidden or empty alt text. Interactive elements are real buttons, links and inputs.

• Partial

  Small mono labels

  Labels are 11px uppercase mono at 7:1 contrast on the base, but panels lighten the background and long tables scroll horizontally on phones. Nothing critical is set in labels alone.

Operations and reliability

• Gap

  Treasury and keeper key

  Set. The keeper can claim fees and the form allows launches.

• Gap

  Model provider key

  Chat answers with a provider error until the OpenRouter key is set and topped up. The pool ledger can say money is available while the provider says no; the top-up is manual.

• Pass

  Scheduled jobs

  A separate cron service calls the indexer, the keeper, payouts, bets, notes, the Agora and offspring every ten minutes. A missed tick delays work; it does not lose it.

• Pass

  Runs without infrastructure

  Every database read tolerates a missing database and returns empty, so the site renders before infrastructure exists. Schema migrations run on every deploy and are idempotent.

Data correctness

• Pass

  Integer micro-USD everywhere

  The pool is an append-only ledger of integers. Each claim records the ETH/USD rate it used; display rounds, storage does not.

• Pass

  Price and progress are live

  Price, market cap and curve progress on token pages come from the curve contract at request time, not from a snapshot.

• Partial

  Volume and holders depend on the indexer

  Trades, 24h volume and holder counts are mirrored from chain logs by the scheduled job and can trail the chain by minutes.

• Pass

  Replies are billed on reported usage

  Costs use the provider's reported token counts, rounded up, so the ledger never under-bills.