The keeper uses two keys, one for Solana and one EVM key that is the same on Robinhood Chain and BNB Chain. They live in keeper/.env on the machine that runs the keeper and are never committed.
The launch page never sees a private key: your Solana wallet signs the deposit.
The EVM keeper address holds only gas money and the launch float. The contracts accept it as the only caller of launch, on both chains.
Contracts
PivotLauncher.launch is callable only by the keeper. It checks the creator fee (at most 10 %) and the payout share (at most 100 %).
The vault pays only to the Pivot address fixed at deployment, or to the creator's address in split().
PivotFlapLauncher.launch is callable only by the keeper. It checks the tax (1 % to 10 %) and the payout share (at most 50 %). The splitter pays only to the creator's address and the Pivot address, and anyone can call harvest and split.
A reentrancy lock covers the vault's state-changing functions and the splitter, and initialize runs once.
12 tests run against a fork of the real Pons and 9 against a fork of the real Flap. There is no audit yet.
The keeper confirms that the token address the Flap Portal created is the one it mined, and logs a warning if not instead of retrying: a retry would launch a second coin.
API
CORS is restricted to the site's origin.
Image type and size are checked before the upload to IPFS.
Rate limits per address, a refusal to quote when the rate sources disagree, and parameters validated before any money is asked.
A deposit counts only if it comes from the wallet in the request and carries the request's reference.
New requests pause when a keeper wallet is below its floor, so a launch is not started that the keeper cannot finish.
What to check
Compare the contract and token addresses with this site and the official X account.