# Security policy for All In (https://solallin.xyz)
# A token launchpad on Solana, built on the Meteora Dynamic Bonding Curve.
# Format: RFC 9116. Lines starting with # are comments that explain the fields.

Contact: https://x.com/solallinxyz
Expires: 2027-11-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://solallin.xyz/.well-known/security.txt
Policy: https://solallin.xyz/security.html

# ----- Addresses to verify -----
# Network:              Solana mainnet-beta
# Meteora DBC program:  dbcij3LWUppWqq96dh6gJWwBifmcGfLSB5D4DuSMaqN
# Meteora DAMM v2:      cpamdpZCGKUy5JxQXB4dcpGPiikHawvSWAd6mEn1sGG
# Site DBC config:      9bCbZLtcTkYEv9mjYyydEC4bPHvwtykkAhjhBrLQWPvw
# Dev wallet:           HdrWuf8yQ225bfzikNU3wgmNbbJnSCg1NbKkm31ELcgK
# Treasury wallet:      6ko3ZsVGv6sNKffc461JXKS696KLFJxCxmtMQoUtqmG7
# Migration wallet:     BZPNxjBSEZ7FYffXpw7E2bQiw1uqtHFTpk8QvwvDUvZc
# Tables on this site have mints ending in "ace" and are listed on the site.
# We will never ask for a seed phrase or private key, and we never DM first.

# ----- How trading works -----
# All In holds no user funds and has no trading ledger of its own.
# A launch is one transaction, signed by the user's wallet and co-signed with a
# one-time mint key. It creates a Meteora DBC pool and, optionally, the launcher's
# first buy. Trades are direct Meteora swaps signed by the user, so any terminal or
# aggregator can route them. Full curves migrate to Meteora DAMM v2 with LP locked.

# ----- Trust model: what is not trustless -----
# - Pots and the jackpot are figures kept by the server, not an on-chain escrow.
#   The SOL behind them sits in the treasury and is paid out by hand after a
#   showdown. Nothing on chain forces those payouts.
# - Cards are public and derived from SHA-256 of mint, nonce and a later block hash.
#   A block's leader has limited influence over that hash.
# - Page checks and quotes come from the same server. They guard against bugs and
#   bad responses, not against a compromised site. A wallet's preview is the last word.
# - The DBC config is permissionless: pools can exist on it outside this site.
# - One person can hold several chairs from several wallets, or buy and sell all nine.
#   Chairs are sold once, so that can leave a table with no game while its token trades on.
# - Balances are read about every 30 seconds and at the showdown: tokens that leave a
#   wallet and return between reads may not fold its hand.

# ----- Keys -----
# The treasury and dev keys are never on the web server. The server holds only the
# migration key, which pays rent for moving full curves, and unused one-time mint keys.

# ----- In scope -----
# - https://solallin.xyz and its API
# - Transactions built by the site, and the checks the page runs on them
# - The rule engine: seats, folds, deals, showdowns and payout figures
# - Exposure of keys, RPC credentials or server files

# ----- Out of scope -----
# - Meteora's programs (report to Meteora), Solana itself, wallets and third-party terminals
# - Token prices, or tokens launched by other users
# - Fake pools on the permissionless config, and lookalike tokens, unless the site lists them
# - Reports from automated scanners with no demonstrated impact
# - Denial of service, spam, social engineering and physical attacks

# ----- Rules for testing -----
# Test only with your own wallets and small amounts. Do not touch other people's funds
# or data, do not degrade the service, and do not use a flaw beyond what proves it.
# Give us a reasonable time to fix a problem before publishing it. We will not pursue
# good-faith research that follows these rules. There is no paid bounty programme.

# ----- What a good report has -----
# The affected address or endpoint, steps to reproduce, the impact, and a transaction
# signature if one exists. Never include a private key or seed phrase.