Security policy
Found a way to claim for a wallet you do not control, to use someone else's code, to cast a ballot that is not yours, to make the project pay a fee it should not, or to read something this site says it never stores? Tell us before you tell anyone else, and we fix it and credit you.
Report
What we keep: the text you write, the kind you choose, the time, and the contact you type if you choose to. We do not keep your IP address, your browser details or your location, and no page ever shows what you send. We cannot promise a reply. Please do not post the details in public. Machine-readable: /.well-known/security.txt.
In scope
This domain, its API under /api/, the claim bundle, the join, vote and sponsor flows, the published JSON files, and the scripts that run the site. Out of scope: Solana, Streamflow, Raydium, Squads, Self and Cloudflare themselves (report to them), and anything on wildcherry.io, which has its own process.
Rules
Test only against wallets and codes you own. Do not run load against the site. Do not touch other people's records. On devnet there is nothing to steal, and that is the point: break it here, not on mainnet.
What you get
A reply within 3 days, a fix with your name (or handle) in the commit and on this page if you want it there, and our thanks. No cash reward is promised: this project publishes no value claims and pays no bounties in a token that has no value. A fixed thank-you in SOL for a serious finding is at the founder's discretion, announced per case, never a rate.
Credits
None yet.
Nobody from this project will ever DM you an address or ask for a seed phrase. Devnet build. No value.