Security · qaissecurity.com
Security first. Verify everything.
Security is in our name, so this page states plainly what we protect, how, and what we will never ask of you. Anything that contradicts this page is not QAISS.
- Neverasks for your seed phrase or private key
- Neverasks you to connect a wallet on this site
- NeverDMs you first or offers private support
- Neverruns airdrops, presales or giveaways
Official channels
If it is not on this list, it is not us.
Social accounts are listed only once the project publishes them. Until then, any account claiming to be the official QAISS profile is unverified.
qAiSsY4QBC75SGeFnrfujt4LTgZyCqinEyD11x5SR6fAlways compare every character with the on-chain record before use. QAISS will never DM you a different address.
- Website
- qaissecurity.com
- Token mint (Solana)
- qAiSsY4QBC75SGeFnrfujt4LTgZyCqinEyD11x5SR6f
- Liquidity pool (Raydium QAISS/SOL)
- 9vQABZsR2D7G3trVYJMt11jJ3Yb7bURjyUrpEfymNZ9R
- X / Twitter
- Not published yet — treat any such account as unverified
- Telegram
- Not published yet — treat any such account as unverified
- Discord
- Not published yet — treat any such account as unverified
- GitHub
- Not published yet — treat any such account as unverified
- Not published yet — treat any such account as unverified
Scam patterns
Six ways people lose crypto, and how to spot them.
Most losses in crypto come from social engineering, not broken cryptography. These are the patterns to watch for around any token, including this one.
Fake “support” in your DMs
QAISS never messages you first, never offers support in private messages, and never asks you to “validate” or “sync” a wallet.
Seed phrase or private key requests
No one legitimate will ever ask for your recovery phrase. Anyone who asks is stealing.
Lookalike tokens
Anyone can create a token called “QAISS”. Only the mint above is ours — compare every character.
Wallet-drainer sites
This website never asks you to connect a wallet or sign anything. A “QAISS” page that does is not us.
Airdrops and giveaways
There is no QAISS airdrop, presale or giveaway. “Send X, get 2X back” is always a scam.
Lookalike domains
Our only website is qaissecurity.com. Check the address bar before you trust a page.
This website
How the site protects you.
A static site with no accounts, no cookies, no analytics and no wallet connection. These are the exact security headers it ships, read from the deployment configuration when the site is built.
- Content-Security-Policy
Only this site’s own scripts can run. No inline scripts, no third-party scripts, no plugins; network calls only to the listed read-only APIs.
default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data:; media-src 'self'; connect-src 'self' https://api.dexscreener.com https://solana-rpc.publicnode.com https://api.mainnet-beta.solana.com; form-action 'self'; frame-src https://dexscreener.com; frame-ancestors 'none'; base-uri 'self'; object-src 'none'; upgrade-insecure-requests- Strict-Transport-Security
Browsers must use HTTPS for two years, including subdomains.
max-age=63072000; includeSubDomains- X-Content-Type-Options
Files are never reinterpreted as a different type.
nosniff- Referrer-Policy
Other sites see only our domain, never the page you were on.
strict-origin-when-cross-origin- Permissions-Policy
Camera, microphone, location, payments and USB are switched off.
camera=(), microphone=(), geolocation=(), payment=(), usb=()- Cross-Origin-Opener-Policy
Other windows cannot script this one.
same-origin- X-Frame-Options
This site cannot be embedded in another page (clickjacking protection).
DENY
Third-party requests are listed in the privacy model. Headers take effect on hosts that read _headers (Netlify, Cloudflare Pages); other hosts must mirror them.
Token
On-chain controls
- Mint authority
- Renounced (null on-chain) — supply cannot increase
- Freeze authority
- Renounced (null on-chain) — accounts cannot be frozen
- Smart-contract audit
- None. QAISS is a standard SPL token; no custom program has been audited.
Post-quantum
Quantum readiness
Solana accounts use Ed25519 signatures, which a large fault-tolerant quantum computer could break. We do not call the token “quantum-secure”. What we know, and what migration would involve, is on its own page.
Read the assessmentImpersonation watch
We look for fake QAISS accounts, so you don’t meet them first.
Once a week, CI runs Sherlock (open source, MIT licence) on the project’s own name and common lookalikes (“qaiss_support”, “qaiss.official”…) across hundreds of sites.
- Project names onlyThe tool checks only names derived from “QAISS”. It is never run on individuals.
- Private resultsMatches go to a private CI report for the team. A name match is not proof of bad intent — “Qais” is also a personal name.
- Human reviewEach match is checked by hand. Only accounts that pretend to be the project are reported, through each platform’s own impersonation process.
- You stay safeThe rule for you is simpler: if an account is not in the official list above, it is not us.
Responsible disclosure
Found a vulnerability? Tell us first.
Report privately, give us reasonable time to fix it, and do not access other people’s data or disrupt the service. We will acknowledge your report, keep you updated and credit you if you wish.
How to report
Email [email protected] with the affected URL or file, steps to reproduce, and the impact. Machine-readable contact details are in /.well-known/security.txt (RFC 9116).
No paid bug bounty is offered at present. Paid technical bounties are listed separately on the bounty board. Safe-harbour terms are pending legal review.
Scope
In scope
- This website and its build output
- The QAISS connector code (connectors/cuquantum)
- Workload Passport and registry verification logic
- Our CI configuration
Out of scope
- Denial-of-service and load testing
- Social engineering of people or third parties
- Third-party services (DEX Screener, Jupiter, Raydium, Solscan, RPC providers, hosting)
- The Solana network itself
- Findings from automated scanners without a demonstrated impact
Page reviewed .