live·1.0.0+78026d4·78026d4·status

Security

labs never asks for a wallet private key.

Report anything that would let the server move funds, serve a different binary than the published source, or leak a secret. Email dev@levercoin.lol. Do not open a public issue.

Email dev@levercoin.lolsecurity.txtPolicy

Wallet

Your wallet signs every transaction. That signature is what authorises the launch, the trade, and the perp. labs does not ask for the private key.

Mint

A launch generates a mint keypair, seals it with LABS_SESSION_SECRET, and uses it only to co-sign the create after the creator's wallet has signed. That key holds no funds.

X tokens

An X connection seals the account's access and refresh tokens with X_TOKEN_ENCRYPTION_KEY, or with X_CLIENT_SECRET when that key is unset. Each connection has a personal key, stored only as a hash.

What to report

Anything that would let the server move funds, serve a different binary than github.com/koynlabs/labs-mcp, or leak LABS_PINATA_JWT, LABS_SESSION_SECRET, a personal X key, X_CLIENT_SECRET, X_CONSUMER_SECRET, X_TOKEN_ENCRYPTION_KEY, or Redis credentials.

MCP

Personal key

The public MCP endpoint requires this header before any X tool or /api/x/media upload runs. A key acts only as the X account that created it.

Authorization: Bearer <personal key>

Wallets

Wallet domain review

Phantom shows "this domain is new" on its own until the domain has been reviewed, and "this dApp could be malicious" when it cannot simulate the transaction. Simulation is fixed in the app. The new-domain warning is cleared by Phantom and Blowfish.

  1. 01

    security.txt

    Confirm security.txt resolves and names this repository.

  2. 02

    Phantom

    If the new-domain warning is still there after a week, submit Phantom's domain review form. Include the domain, what the signer is authorising (a pump.fun or StonkFun create, plus the creator's own buy), the public GitHub repo, and a link to a sign page whose simulation succeeds.

  3. 03

    Blowfish

    Email review@blowfish.xyz with the same packet. Blowfish is the scanner behind Phantom's malicious-dApp warning.

  4. 04

    Signing

    Multi-signer launches stay on signTransaction. The wallet signs first. The mint key co-signs after. Do not switch them to signAndSendTransaction. Warnings docs: Domain and transaction warnings.

Production is https://labs.levercoin.lol. The version in the header carries the git SHA of that deploy (1.0.0+<shortsha>). Match it to a commit on main.