# Security policy for CODE BLUE (https://codeblue.lol)
# A token launchpad on Solana, built on the Meteora Dynamic Bonding Curve.
# Format: RFC 9116. Lines starting with # are comments that explain the fields.

Contact: https://codeblue.lol/security.html
Expires: 2027-11-03T00:00:00.000Z
Preferred-Languages: en
Canonical: https://codeblue.lol/.well-known/security.txt
Policy: https://codeblue.lol/security.html

# ----- Addresses to verify -----
# Network:              Solana devnet until mainnet is announced
# Meteora DBC program:  dbcij3LWUppWqq96dh6gJWwBifmcGfLSB5D4DuSMaqN
# Meteora DAMM v2:      cpamdpZCGKUy5JxQXB4dcpGPiikHawvSWAd6mEn1sGG
# Patients on this site have mints ending in "cpr" and are listed on the site.
# We will never ask for a seed phrase or private key, and we never DM first.

# ----- How trading works -----
# CODE BLUE holds no user funds and has no trading ledger of its own.
# A launch is one transaction, signed by the user's wallet and co-signed with a
# one-time mint key. It creates a Meteora DBC pool and, optionally, the launcher's
# first buy. Trades are direct Meteora swaps signed by the user, so any terminal or
# aggregator can route them. Full curves migrate to Meteora DAMM v2 with LP locked.

# ----- Trust model: what is not trustless -----
# - Crew shares, chart funds, the shift fund and the health fund are figures kept by
#   the server, not an on-chain escrow. The SOL behind them sits in the treasury and
#   is paid out by hand. Nothing on chain forces those payouts or buybacks.
# - Vitals, pulses and codes are this site's reading of public trades. A token with
#   no pulse still trades, and a status is not advice about its value.
# - The check on related wallets looks at who funded a wallet first. Wallets funded
#   through an exchange, or with a long history, are not seen as related.
# - Page checks and quotes come from the same server. They guard against bugs and
#   bad responses, not against a compromised site. A wallet's preview is the last word.
# - The DBC config is permissionless: pools can exist on it outside this site.
# ----- Keys -----
# The treasury and dev keys are never on the web server. The server holds only the
# migration key, which pays rent for moving full curves, and unused one-time mint keys.

# ----- In scope -----
# - https://codeblue.lol and its API
# - Transactions built by the site, and the checks the page runs on them
# - The rule engine: pulses, codes, crews, prizes and payout figures
# - Exposure of keys, RPC credentials or server files

# ----- Out of scope -----
# - Meteora's programs (report to Meteora), Solana itself, wallets and third-party terminals
# - Token prices, or tokens launched by other users
# - Fake pools on the permissionless config, and lookalike tokens, unless the site lists them
# - Reports from automated scanners with no demonstrated impact
# - Denial of service, spam, social engineering and physical attacks

# ----- Rules for testing -----
# Test only with your own wallets and small amounts. Do not touch other people's funds
# or data, do not degrade the service, and do not use a flaw beyond what proves it.
# Give us a reasonable time to fix a problem before publishing it. We will not pursue
# good-faith research that follows these rules. There is no paid bounty programme.

# ----- What a good report has -----
# The affected address or endpoint, steps to reproduce, the impact, and a transaction
# signature if one exists. Never include a private key or seed phrase.