, holding one paragraph: Quantum Squeak needs JavaScript: it reads Squeektoshi's rounds from Sepolia and casts nets from your wallet. Style it only inline (text-align center, padding 24px), with no new class.","parentJobId":null,"planHash":"53182a03005f44e5c5963e4feda2ee0c98aecd6eb1fe66f5d88fc93ddf755c33","previousHash":"8ca6724466faba40ad05ef3859c083c1a0896d2113874c1c71a8f2c412ce94dd","projectId":"41081772-a92d-4b5d-8108-eea351d14e8f","publication":{"commit":"70c4bca4110053fe7566625dc97f64d3c63fee42","deliveredAt":"2026-11-07T12:58:41.343Z","repoUrl":"https://github.com/identity-md-launches/launch-3108-quantum-squeak-free-browser"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[],"site":{"cid":"bafybeifujhp3czr5gka5ga6xyoqe7fgy6vsmjpdwthgd5vjccbrc2v7sze","ensName":"quantum-catch.identitymd.eth","namingTransaction":"0x0be93a615dfe21efdf40dbd2aac7fe8d54650699bfc6847a7623ad285d229a9e"},"snapshotHash":"baa3aeebcc7fc7382fda2a00cd506a077690d871be22e600d844646d8734aa26","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"523b06a3dd921f5d","findings":[{"citation":"resolved","description":"wheel/out/quantum-catch.html is a build output of the same game (same QuantumCatchV3 0x5331631708adff57965aab4bba5453be35e30b30, the same wallet code and the 'Not made by the Squeekchain team' line), but it is a body fragment: no , no /, no canonical, og:url, og:site_name or twitter tags, and no noscript notice. Pinning the whole repository root also publishes it, and wheel/out/results.json next to it, at /wheel/out/quantum-catch.html. A shared link to that path gets no card, and with JavaScript off it shows nothing. It asks for nothing beyond what index.html asks for, so this does not stop hosting. It is advisory: leave wheel/out/ out of the export or rebuild it from index.html.","line":1,"path":"wheel/out/quantum-catch.html","reproduction":"Host the repository root and open /wheel/out/quantum-catch.html. View source: line 1 is
with no doctype. `grep -c 'og:url' wheel/out/quantum-catch.html` gives 0 and `grep -c '
","title":"A second copy of the game, wheel/out/quantum-catch.html, is served if the repository root is hosted, without the head tags or noscript added to index.html"}],"hash":"8a788993952f74b11f87936cbe9bad80e2771b3c95380fd8ec53109ecf9ba547","nodeId":"4fc98a26-dd6e-4d02-849f-dbd088c4e8ba","outcome":"completed","summary":"I found nothing critical or high, so nothing should stop the site from being hosted. The two fixes you asked for are already in `index.html`, and I changed no files. `.imd-findings.json` holds one low-severity note.\n\n**The two fixes**\n- **Link card:** directly after `og:type`, `index.html:10-15` has the canonical link, `og:url`, `og:site_name`, `twitter:card` set to `summary`, and `twitter:title` and `twitter:description` with exactly the `og:` text. There is no `og:image` or `twitter:image`, and the first five lines are unchanged from the previous commit.\n- **Notice without JavaScript:** `index.html:800` is one `noscript` with the exact paragraph, styled only inline (`text-align: center; padding: 24px`), directly before the first ``.\n- **Your other limits:** there are no en or em dashes and no `console.` calls, and no script, image or dependency was added.\n\n**What the page asks for**\n- **Wallet:** it connects with `eth_requestAccounts` and switches or adds Sepolia (`0xaa36a7`) only (`index.html:1564-1585`).\n- **Casting a net:** the permit (`index.html:1700`) is for exactly the contract's `NET_COST`, with QuantumCatchV3 as the spender. `NET_COST` is fixed in the contract (`immutable`, `contracts/src/QuantumCatchV3.sol:119`). The fallback is `approve(contract, cost)` for the same amount (`index.html:1716`). Before anything is signed, the page checks that the contract takes the configured test SQK token (`index.html:1690`).\n- **Faucet:** one `claim()` on SqkFaucet `0xf0a8…35f3`, with no value sent (`index.html:1782-1800`).\n- **Never asked for:** a seed phrase, a private key, a password, a mainnet asset, another token or an unlimited approval.\n- **Disclaimer:** \"A community project. Not made by the Squeekchain team.\" appears in the footer (`index.html:1038`) and in `README.md:20`.\n\n**Scripts and outside requests**\n- **Code:** there are three inline scripts and none loaded from elsewhere. Nothing uses `eval`, `new Function`, `document.write`, dynamic `import`, iframes or redirects.\n- **Big data lines:** `index.html:1901-1902` are plain data objects (the nights' results and the base64 WebP pictures), with no code in them.\n- **Network requests:** the page talks to\n - `results.json` on the same site;\n - the public Sepolia RPC, read-only;\n - `api.squeekchain.com/v1/status`, from which it reads only whether the wheel is turning and fresh, and shows that as a light;\n - Google Fonts.\n- **No tracker:** there are no analytics or tracking scripts.\n- **Pictures:** net pictures read from the chain are only drawn into images and canvases, never inserted as HTML.\n- **Repository:** no keys or tokens are committed, and the posting scripts say they load no key.\n\n**The low finding:** `wheel/out/quantum-catch.html` is a build copy of the same game (same contract). It would also be published if the whole repository root is pinned. It has no doctype or head, none of the new link-card tags and no noscript notice. It asks for nothing more than `index.html` does. Leaving `wheel/out/` out of the export, or rebuilding it, would fix it.\n\nI didn't write Foundry proofs, since they're only needed for critical or high findings in contracts.","treeHash":null,"usage":{"cachedInputTokens":717020,"cost":{"source":"runtime","usdMicros":675550},"inputTokens":36,"model":"claude-opus-5-5","outputTokens":7838,"runtime":"claude","turns":19,"wallClockMs":119810}},{"artifacts":[],"attempt":1,"bundleHash":"26c28792eba771e8d9a1f6a45967836dbf61a3b67856f4019fb92f7c858de511","device":"02a7451bfdfa1a37","findings":[],"hash":"bf80c10d18a879aece52704415e444e1d192da361b443b8faa22addeb877eddd","nodeId":"0278c442-18ef-4bd7-9d9f-351606c972dc","outcome":"completed","summary":"Updated only `index.html` with six sharing metadata tags and the inline-styled JavaScript notice.\n\nChecks passed: first five lines unchanged, all original bytes preserved, metadata matches exactly, notice placement correct, and `git diff --check` clean. No dependencies or assets added. No deployment performed.","treeHash":"5775f2e97778dc8f9dbeed3b34b6e99c312a0f4f","usage":{"cachedInputTokens":56960,"inputTokens":7509,"model":null,"outputTokens":1036,"runtime":"codex","turns":2,"wallClockMs":31686}}],"verification":[{"checks":[],"detail":"paths and tree verified; no suite was run for this kind of work","evaluation":"structural","profile":"none","status":"accepted","submissionHash":"bf80c10d18a879aece52704415e444e1d192da361b443b8faa22addeb877eddd","verifiedTreeHash":"5775f2e97778dc8f9dbeed3b34b6e99c312a0f4f","verifierVersion":"0.1.0+18543036"}]}