Built to be un-ruggable — and un-hackable.
A tool that tells you what's safe has to be safe itself. Here's exactly how we protect you — and how you can verify every word of it.
Our security posture
We never move your funds
No component ever requests a transaction, token approval, or spend signature — only a message that proves wallet ownership. This is enforced by an automated CI check, not just a promise.
Hardened against XSS & clickjacking
Strict Content-Security-Policy, HSTS, frame-ancestors DENY, COOP and a locked-down Permissions-Policy on every page.
Every input is validated
A central validation layer rejects any malformed address or query before it touches an RPC, database, or outbound request (SSRF-safe).
Abuse-resistant
Public endpoints are rate-limited; edge/WAF hardening is layered on top as traffic grows.
Automated security in CI
Every push is scanned for leaked secrets (gitleaks) and vulnerable dependencies — a known-critical advisory blocks the build. We patch, or track it transparently.
Open & auditable
The scanner, bot and this site are open source. A living threat model and risk register are maintained in the repo. Anonymous team, fully verifiable code.
Our promises to you
Your protection is free — forever
Scanning, plain-English explanations and the safety verdict are free for everyone and are NEVER gated behind holding $GL1TCH. Holding only unlocks convenience (speed, depth, automation) — never the protection itself.
Plain language, not a black box
Every risk finding comes with a clear 'why this matters', and every claim links to on-chain proof you can verify yourself.
Probabilistic, never accusatory
We say 'this pattern matches projects that later rugged', never 'this is a scam' — and any project can appeal a flag through a verified process.
Not financial advice
Every score is a risk signal, not investment advice. Crypto is high-risk; always DYOR.
⚠ How to spot a fake GL1TCH
The biggest risk isn't us — it's a copycat site pretending to be us.
- GL1TCH will NEVER ask you to approve a transaction or a token spend.If a "GL1TCH" site asks you to Approve, Confirm, or sign anything that moves funds or grants an allowance — it is a scam. Close it.
- The only signature we would ever request is a plain-text message that says it proves ownership and moves nothing. Read what you sign.
- Only trust the official domain: coin-three-mu.vercel.app and the links on our official links page. Admins never DM first.
Responsible disclosure
Found a vulnerability? We want to hear it before anyone gets hurt. Report it privately via our Telegramadmins or a GitHub security advisory — please don't disclose publicly until it's fixed. A formal bug-bounty program is on the roadmap.