Review feedback: nonced scripts may load further scripts at runtime under
'strict-dynamic', so "only scripts carrying the nonce run" overstated the
policy. SECURITY.md and the buildCsp doc comment now say what is trusted
and what is not.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01GkReG2zjRq3Ts7YqdgjaaJ
Every page now carries a per-request Content-Security-Policy. The proxy
mints a nonce, Next.js stamps it on its inline scripts, and the root layout
forwards it to next-themes. Scripts run only with the nonce plus
strict-dynamic; framing is denied; connect-src covers the site and the
Coinbase Wallet SDK endpoints; images allow https because token logos are
user-supplied URLs validated server-side.
Static headers (nosniff, X-Frame-Options, Referrer-Policy,
Permissions-Policy, HSTS) apply to every route from next.config.ts.
Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01GkReG2zjRq3Ts7YqdgjaaJ
- Metadata registration is INSERT-only for unsigned callers: the creator registers before broadcasting
(salt still private); replaying the public launch params returns 409 and cannot overwrite image /
description / website. Later changes go through the wallet-signed edit flow. (review finding 1)
- The on-chain metadataURI is keyed by a client-chosen meta_key instead of the salt, so findSalt's
result stays valid for USDG / stock quotes. Proven on the live Robinhood factory: 17/100 deterministic
USDG launches reverted with the old scheme, 0/100 with the new one. (finding 2)
- Swap and fee ingestion commit the event row and the launch totals in one transaction; a rebuild script
recomputes totals from raw events if ever needed (production checked: no drift). (finding 3)
- Fresh checkout: npm run migrate reads DATABASE_URL from .env.local/.env; fly-secrets.sh is self-contained
(FLY_APP, SECRETS_ENV); README run + deploy steps corrected.
- CI workflow (lint, typecheck, unit tests, production build; forge build + unit tests), CONTRIBUTING.md,
SECURITY.md with private reporting.
