Zero bytes
No scripts at all. The CSP sets script-src 'none', so nothing can run, injected or otherwise.
Trust center Claims you can check
What we claim, what we don't, and how to check.
Every row in the ledger is true today. Solana is in devnet testing. Nothing is live. No settled receipt exists. Proofs so far ran on a local validator.
Claims ledger
| Claim | Status | How to verify |
|---|---|---|
| Solana program | In testing | In devnet testing. Nothing is live. This site publishes no program address and no transaction. |
| Settled receipts | None | No settled receipt exists. There is nothing to replay. Proofs so far ran on a local validator. |
| 0.5% integrator fee | Planned | Not in effect. The terms draft does not set a fee. No fee is captured on this site. |
| Screened funnel and listing site | Not built | This website is a brochure. It does not list tokens or show a screen verdict. |
| Telegram trade bot and swap widget | Not launched | t.me/solfluxhq is a channel, not a trade bot. No widget is embedded anywhere from this site. |
| API, SDK and browser extension | Not built | No API reference, package or extension is linked because none exists. |
| Tron, EVM, TON and Move | Planned | Research in progress. No chain order. Tron and TON are not last. Nothing in that set is live. |
| Private monitor | Private | Access-gated and not linked. The hostname is not on this site. It is not proof of a receipt. |
This site Secure by build
Built to the standard we sell.
A security company's website should pass its own audit. Here is what you can check on the files this site ships. The apex hostname is a deploy-time concern and is not claimed as measured here.
Zero
No analytics, ad pixels, tag managers or third-party requests. Every asset on these pages is served from this site.
Strict CSP and more
The CSP denies everything by default, plus object-src 'none', base-uri 'none', framing denied, HSTS, nosniff and a strict referrer policy.
Pinned assets
The stylesheet has a content-hashed filename and Subresource Integrity (SHA-384). Fonts are self-hosted and OFL-licensed.
Two-sided build checks
A secret-leak scan and a forbidden-string scan run over every shipped file. Each is shown to go red on a planted sample before we trust it to go green. CI runs the same gates.
RFC 9116
security.txt with a contact, an expiry, a policy, a canonical URL and acknowledgments. No encryption key is published yet. Read the policy.
Legend Status colors
One status language everywhere.
The same words are used on every page. Green on a severity table means low severity. It does not mean a product is live.
| Color | Meaning |
|---|---|
| Red | Critical severity: funds at risk. |
| Orange | High severity. |
| Amber | Medium severity, or in devnet testing. Not live. |
| Green | Low severity. Not a chain-status color. |
| Grey | Not built, not launched, or private. |
| Blue | Planned, with research in progress. Not a sequence and not a date. |
Risk Read this
Memecoins are high risk. This site does not screen them.
Memecoins are extremely volatile and you can lose everything you put in. Screening before buy is not built, so this site does not catch honeypots or rugs. Nothing here is financial, investment or legal advice. See the draft terms, which are not in effect.