The keeper uses two keys, one for Solana and one for Robinhood Chain. They live in keeper/.env on the machine that runs the keeper and are never committed.
The launch page never sees a private key: MetaMask signs the deposit.
The Robinhood keeper address holds only gas money. The contracts accept it as the only caller of launch.
Contracts
HingeLauncher.launch is callable only by the keeper. It checks the creator fee (at most 10 %) and the payout share (at most 100 %).
The vault pays only to the Hinge address fixed at deployment, or to the creator's address in split().
A reentrancy lock covers the vault's state-changing functions, and initialize runs once.
12 tests run against a fork of the real Pons. There is no audit yet.
API
CORS is restricted to the site's origin.
Image type and size are checked before the upload to IPFS.
Rate limits per address, a refusal to quote when the rate sources disagree, and parameters validated before any money is asked.
A deposit counts only if it comes from the wallet in the request and carries the request's reference.
What to check
Compare the contract and token addresses with this site and the official X account.