{
  "claims": [
    {
      "claim": "No PHP application runtime",
      "evidence": "Own source, package-lock inventory and JavaScript Worker artifact.",
      "boundary": "Applies to the packaged application. Does not attest every service run by hosting or RPC providers."
    },
    {
      "claim": "No application SSH server",
      "evidence": "HTTP Worker entrypoint, own source and declared hosting configuration.",
      "boundary": "Not proof that the hosting provider never uses SSH internally. Closed ports alone are not evidence of this claim."
    },
    {
      "claim": "Release asset integrity",
      "evidence": "Browser SHA-256 comparisons and downloadable verifier.",
      "boundary": "Manifest and code are self-published. Compare a trusted out-of-band fingerprint; a compromised origin could replace both."
    },
    {
      "claim": "No custody of user wallet keys",
      "evidence": "Browser transaction construction and wallet signing code.",
      "boundary": "A compromised frontend can still request a malicious signature. User wallet approval is essential."
    }
  ],
  "independentAudit": {
    "status": "not_commissioned",
    "report": null
  },
  "productionDeploymentAttestation": {
    "status": "not_independently_verified",
    "report": null
  },
  "knownVulnerabilities": {
    "php": [
      "CVE-2026-109618",
      "CVE-2026-109619"
    ],
    "explanation": "The affected PHP runtime is absent from this packaged application. This does not establish immunity to unrelated flaws."
  },
  "externalDependencies": [
    "Cloudflare / Sites hosting and R2",
    "Operator-configured Solana RPC (Alchemy)",
    "DEX Screener and Coinbase public market data",
    "Wallet extension",
    "Pump.fun and related Solana programs"
  ],
  "publicMetadataConfiguration": "configured",
  "testEvidence": "See tests/ in the source snapshot and local npm test output. No funded end-to-end coin launch is claimed."
}