🛡️ Security

What we have done to keep Craic Hub Exchange safe, written plainly. This is our own self-review, not an independent audit. No website can promise to be risk-free: always check what you sign in your own wallet.

How the exchange is built

• Non-custodial. Every trade, order and launch is signed in your own wallet. We never ask for, see or store a seed phrase or private key, and we never hold your coins.
• No unlimited approvals. Our own code never asks your wallet for an unlimited token approval.
• Check before you sign (Auto Trade). Before your wallet opens, the site decodes the transaction and shows what leaves your wallet and which programs it uses. It blocks unknown programs, unlimited approvals, authority changes and transactions where you are not the fee payer.
• Stop-loss is not offered because the only provider option today moves coins into a custodial vault.
• Fees are shown before you sign. Fees paid in $CRAIC are burned.

Website protections

• Strict Content Security Policy with a fresh random nonce on every page, no inline scripts or inline event handlers, object-src 'none', base-uri 'none'.
• HTTPS only with HSTS (2 years, includeSubDomains), X-Frame-Options DENY with framing allowed only for the Telegram Mini App, nosniff, a strict Referrer-Policy, a Permissions-Policy that turns off camera, microphone, location and payment APIs, and Cross-Origin-Opener/Resource policies.
• The Jupiter swap plugin and the Telegram SDK are served from our own domain at pinned versions, with Subresource Integrity on the Jupiter loader.
• Dependencies are pinned to exact versions; the cross-chain swap bundle (LI.FI v4) had 0 known vulnerabilities on npm audit on 25 Oct 2026.
• Per-connection rate limits on every API, input checks on every form and endpoint, and HTML escaping of all user and API text.
• No secret keys are shipped to your browser. Server secrets live only in Cloudflare's encrypted settings.
• Free public scanners on 25 Oct 2026: Mozilla HTTP Observatory A+ (12/12 tests) and securityheaders.com A+.

Stay safe

• The only official site is thehubexchange.com. Check the address bar. We will never DM you first, ask for your seed phrase, or ask you to "validate" or "sync" a wallet.
• Read every wallet pop-up. If it asks to approve unlimited spending or to change an account owner, reject it.
• New coins are extremely risky. Use the safety check on each coin page, and DYOR. Not financial advice.

Report a security issue

Found a bug or a phishing copy of this site? Email craiccoin@mail.grokbot.com with steps to reproduce. Please don't test against other people's wallets or funds, and give us a reasonable time to fix it before going public. We'll credit you on this page if you'd like. See also security.txt.

Last updated 25 Oct 2026.