Security Policy

Effective July 25, 2026 · Cinder, a non-custodial utility on Robinhood Chain · Not affiliated with Robinhood Markets, Inc.

1. Architecture is the first control

Cinder is a static, client-only interface with no custom smart contracts and no server in the path of any asset. Every asset-moving action is a transaction you sign in your own wallet, executed by either the token contract itself or public Uniswap contracts that secure real value on Robinhood Chain. The one server-side component is an append-only statistics log holding wallet addresses, action types, and transaction hashes, all data the chain already publishes. It stores no secrets, cannot move assets, and its shipped credentials permit insert and read only, never update or delete. Leaderboard entries are verified against the chain before display, so writing fake rows to the log buys an attacker nothing visible.

2. Controls in the interface

Token approvals are scoped to the exact amount being sold, never unlimited, and Permit2 permissions expire within 30 minutes. Continuous tests fail if an unlimited approval ever reappears.
A strict Content-Security-Policy allows scripts only from cindereth.com, network calls only to the chain's RPC and explorer, and refuses all framing, which blocks clickjacking overlays on the connect button.
All JavaScript is self-hosted and version-pinned. No CDN sits in the trust chain, and the build fails if a third-party script host appears.
Token names and symbols are treated as hostile input and neutralized against markup and spreadsheet-formula injection, and a hostile token is part of the automated test suite.
Sells carry an on-chain minimum-received bound, so a manipulated quote cannot make a swap execute below your slippage setting.

3. Testing

Every build passes three automated suites before deploy: transaction-encoding tests verified byte-for-byte against transactions that succeeded on Robinhood Chain mainnet, an end-to-end browser suite against a mocked wallet, and a suite that serves the site with its exact production security headers and drives the real buttons.

4. What Cinder will never do

Never ask for your seed phrase or private key, anywhere, for any reason.
Never contact you first. Anyone DMing you "from Cinder" is an impersonator.
Never airdrop tokens, run "claim" campaigns, or ask you to send assets anywhere.
Never present its own signing prompt. Signing happens only inside your wallet.

The only real site is cindereth.com. Treat lookalike domains as hostile.

5. Reporting a vulnerability

Write to security@cindereth.com with a description, reproduction steps, and your assessment of impact. You will get a human reply, an honest assessment, a fix as fast as one can be shipped, and public credit if you want it. There is no paid bug bounty yet; when one exists, this page will say so.

6. Responsible disclosure

Good-faith research is welcome. Do not exploit an issue beyond what proves it exists, do not access or modify other people's data or assets, do not degrade the service, and give a reasonable window for a fix before public disclosure. Cinder will not pursue action against research that follows these rules.

7. Scope

In scope: the cindereth.com interface, its build pipeline, and the statistics log's access rules. Out of scope: the Uniswap protocol contracts, wallet software, Robinhood Chain infrastructure, Blockscout, token contracts, social engineering, and denial of service. Issues in third-party components should go to those projects, though a heads-up is appreciated.