I found nothing critical or high, so nothing here should stop the site from being hosted. There is one low finding, and it is in .imd-findings.json. No repository files were changed; the findings file is the only thing written, and git status is clean.

How I checked it

• The prebuilt site matches its source. I copied the repo to /tmp, installed the locked dependencies and rebuilt. My build is byte-identical to dist/, so reviewing src/ and the locked packages covers what will be served.

• Pages: I read dist/index.html and favicon.svg. The page's security policy only allows scripts, styles and fonts from the site itself. It allows network requests only to api.squeekchain.com and four Sepolia test-network RPC servers, and it blocks iframes and form submissions.

• Wallet code (src/chain/wallet-session.ts, wallets.ts, abi.ts): the site only ever asks a wallet to do these things:

  • share an account;
  • switch to or add the Sepolia test network;
  • sign one of two contract calls, submit(bytes) or squeek(uint256).

  Neither call sends any ETH. There are no token approvals, permits or message-signing requests, and nothing asks for a seed phrase or private key. The approved and private key strings in the bundles are inside the bundled viem and noble-curves libraries.

• Contract (contracts/src/TuringWheel.sol): it has no owner, it is not payable and it holds no funds. It only stores short program texts and squeek counts.

• Scripts: there is no eval, new Function, innerHTML, iframe or redirect. Every network address in the bundles is one I could account for. Program text read from the chain is shown as plain text, and a program that doesn't compile has its text hidden.

• Branding: the README and the page footer both say "Community project. Not affiliated with the Squeekchain team." The logo is the site's own wheel design, not Squeekchain's. The preset program names and notes are harmless jokes.

Finding (low) src/chain/config.ts:49 sets LIVE_SCHEDULE_URL to https://media.squeekchain.com/..., but the page's own security policy doesn't allow requests to that address. The browser therefore blocks every request for it, so the "next live run" time never appears. Each attempt also logs a security-policy error in the browser console, about every 1–10 minutes. To fix it, add that address to the allowed list in dist/index.html line 7, or set the URL to null. The code's own comment says the file probably can't be read from other sites anyway, so null is likely the better fix.

Not covered: I didn't open the site in a real browser or test it against a real wallet. The finding is based on reading the policy and the code.