Self-review.

The X and website links of a launch were stored as free text and rendered straight into the href of the token page. A javascript: address would have run for everyone who opened that page.

The launch endpoint accepts only http(s) URLs for the logo, X and website fields; the form checks them before the wallet signs, so no gas is spent on a launch the site would refuse; and the token page renders a link only when it starts with http(s), whatever the database holds.

The policy allowed everything except being embedded in another site. Scripts and styles could be loaded from any origin, and there was no Permissions-Policy.

Scripts and styles are limited to this origin (inline still allowed, which Next itself needs), images may come from any HTTPS origin because token logos and provider icons live elsewhere, plugins are blocked, forms may only post here, and camera, microphone, geolocation, payment and USB are switched off.

Every click on Connect opened a picker, even when only one of the two supported wallets was installed, and the picker sniffed window objects that MetaMask and Phantom both spoof.

The site asks each wagmi connector whether its provider exists. With exactly one wallet present the extension opens straight away; with two or none the picker appears, and install and mobile deep links open in a new tab.

The treasury address is the zero address until the operator sets it. A launch made in that state would name nobody as fee recipient and its 2% would be unreachable.

The launch form refuses to submit while the treasury is unset and says why. Nothing can be launched from this site until the address and the keeper key are in place.

www.useagora.ink was verified first. The bare domain had a CNAME at the zone apex, which the DNS standard discourages, so resolvers answered inconsistently and the certificate took longer to issue.

The certificate for useagora.ink is issued and the root now serves the site. An ALIAS record at the apex would still be cleaner than a CNAME and is the recommended change at the registrar.

Every write carries a wallet address, a timestamp and a signature over them; signatures expire after ten minutes and there is no cookie or session to steal. Unauthenticated calls to /api/me, /api/launch and the persona and memory endpoints answer 401.

The launch endpoint reads the factory record from chain, checks the curve, the fee recipient and the deployer against it, and rejects anything that does not match. A request body cannot claim a token it did not launch.

Keys are stored as SHA-256 with a short prefix for recognition and shown once. Per-minute rate limits and daily caps in micro-USD bound what any key or wallet can spend from the pool.

Uploading a token image needs a wallet signature, is limited to ten a minute per wallet and one megabyte, and the type is read from the file's own bytes, not from the request. The browser shrinks images to 512 px before sending.

Cron, the pool adjustment and the offspring veto require CRON_SECRET; without it they answer 401. The keeper's private key lives only in the server environment and never reaches the browser.

HSTS with preload, X-Frame-Options DENY, nosniff, a strict referrer policy, a content security policy and a permissions policy are set on every response.

The policy permits inline scripts because the framework emits them. A nonce-based policy needs middleware and is the next step.

The keeper is a spender, not an owner: it can claim fees and launch offspring, it cannot mint or touch locked liquidity. After every claim it forwards everything above a gas reserve to the owner's wallet, whose key is not on the server, so the key on the server never guards more than a few dollars. pons v2 itself has no third-party audit, and that is the largest open risk.

Home, markets, token and docs pages render on the server. Time to first byte on the live deployment is about a quarter of a second and the home page is under 45 KB of HTML.

The model catalogue is cached in memory for ten minutes and in the database for an hour. Curve reads go through multicall with a timeout, and tables fall back to indexed numbers when the RPC is slow.

Instrument Sans and DM Mono are served from this origin with font-display swap. The hero chart, the background and the brand mark are code, not images.

Provider icons come from a favicon service. A cached copy per provider would remove the dependency.

Every page sets a title and inherits the site description from one brand config. The Open Graph image is generated in code with the brand's own font.

Each token page generates its own title and description from the launch and uses the token logo as its share image.

The sitemap lists every public page plus a page per listed token and is rebuilt on request; robots allows the site and keeps crawlers out of the API and MCP.

Canonical URLs point at useagora.ink, which is served with its own certificate; www.useagora.ink works as well.

The hero chart draws its final frame and the background blobs stand still under prefers-reduced-motion.

The chart, the rails, the brand mark and token logos carry aria-hidden or empty alt text. Interactive elements are real buttons, links and inputs.

Labels are 11px uppercase mono at 7:1 contrast on the base, but panels lighten the background and long tables scroll horizontally on phones. Nothing critical is set in labels alone.

Set. The keeper job confirmed that its key matches the treasury address, and the form allows launches. The treasury holds ETH for gas.

Chat answers with a provider error until the OpenRouter key is set and topped up. The pool ledger can say money is available while the provider says no; the top-up is manual.

A separate cron service calls the indexer, the keeper, payouts, bets, notes and offspring every ten minutes. A missed tick delays work; it does not lose it.

Every database read tolerates a missing database and returns empty, so the site renders before infrastructure exists. Schema migrations run on every deploy and are idempotent.

The pool is an append-only ledger of integers. Each claim records the ETH/USD rate it used; display rounds, storage does not.

Price, market cap and curve progress on token pages come from the curve contract at request time, not from a snapshot.

Trades, 24h volume and holder counts are mirrored from chain logs by the scheduled job and can trail the chain by minutes.

Costs use the provider's reported token counts, rounded up, so the ledger never under-bills.