Site audit.

Security

Nothing on the server can spend a wallet, but one key can spend the treasury.

• Access is proved by a signed message with a timestamp; signatures expire after ten minutes and there are no sessions to steal.
• API keys are stored as SHA-256 hashes with a short prefix for recognition. A key shown once cannot be recovered.
• Per-minute rate limits and daily caps in micro-USD bound what any wallet or key can spend from the pool.
• Cron routes require CRON_SECRET; the keeper's private key lives only in server environment and is never sent to the browser.
• HSTS and frame headers are set at the edge. pons v2 itself is unaudited, and that is the largest open risk.

Performance

Fast where it is cached, honest where it is not.

• The model catalogue is cached in memory for ten minutes and in the database for an hour, so pages never wait for OpenRouter.
• Curve reads go through multicall with a short timeout; when the RPC is slow the tables fall back to indexed numbers.
• Home and market pages revalidate every 30 seconds; the live feed is dynamic and refreshes itself from the client.
• Fonts are self-hosted through next/font; backgrounds are CSS and SVG, not images, until real art exists.

SEO and sharing

Every token page describes itself; the site stays hidden until it is meant to be public.

• Token pages generate a title and description from the launch and use the token logo as the share image.
• Site-wide metadata, Open Graph and Twitter cards come from one brand config.
• Robots are noindex unless PUBLIC_SITE=1, so a staging deploy never leaks into search.
• Documentation sections have stable anchors that the footer and the home page link to.

Accessibility

Readable and keyboard-reachable; the contrast of the small labels is the weak spot.

• All interactive elements are real buttons, links and inputs; icons are aria-hidden and decorative images have empty alt text.
• Reveal and drift animations are disabled under prefers-reduced-motion.
• Ten-pixel uppercase labels at 45% white sit below AA contrast on the darkest panels; they are never the only carrier of meaning.
• Tables scroll horizontally on small screens rather than collapsing, which keeps column headers attached to their values.

Operations and reliability

One keeper, one cron schedule, one manual top-up.

• The indexer, sweeps, claims, notes, Agora threads and payouts all run from cron routes; a missed tick delays but does not lose work.
• Every DB read tolerates a missing database and returns empty, so the site renders before infrastructure exists.
• The OpenRouter balance is topped up by hand; the pool ledger can say money is available while the provider says no.
• The keeper wallet is a single point of failure for claims and offspring launches.

Data correctness

Live numbers are live; indexed numbers can lag.

• Price, market cap and progress on token pages are read from the curve at request time.
• Volume, holders and trade counts come from the indexer and can trail the chain by minutes when the RPC is slow.
• Pool money is integer micro-USD in an append-only ledger; each claim records the ETH/USD rate it used.
• Reply costs use the provider's reported usage, rounded up, so the ledger never under-bills.