Keys
Vault keys are generated server-side, encrypted at rest, and only loaded by the sweeper. They never reach the browser.
Proving ownership
- Recipients prove an account is theirs with a one-time code in its public bio — no passwords, no OAuth, no app permissions.
- Codes expire after 30 minutes; a verified claim must be paid out within 30 minutes.
- Payouts are atomic and idempotent: a claim can be paid once, and never more than the ledger owes.
Abuse
Coins that impersonate a person or project, or that target someone who asks not to be paid, can be delisted from Launches. Fees already earned are still paid to the named recipient.
Reporting
Found a vulnerability? Please report it privately before disclosing it publicly.