Reporting a vulnerability

A SECURITY.md with a full disclosure process will be published before the first release. Until then, report a suspected vulnerability privately through GitHub's security advisories for the public repository. Do not open a public issue for a security report.

What Clanker Coin will never ask for

Nobody legitimately representing Clanker Coin will ever ask you for:

• Your wallet seed
• A private key
• Your recovery phrase

If anyone asks for any of these, whatever they are offering, it is not us.

Verifying downloads

Every release publishes a SHA-256 checksum on its GitHub release page. Check a download against it before you run anything. Obtain Clanker Coin software only from clanker-coin.com and github.com/ClankerCoin; nowhere else is us. Code signing is not yet in place for these builds, so the checksum on the release page is currently the way to confirm what you downloaded matches what was published.

Phishing and impersonation

Expect impersonation: fake sites, fake social accounts, and fake “support” contacts that copy this project's name and branding. None of them can recover a lost seed, and none of them need your seed for any legitimate reason. Treat any unsolicited contact offering CLKC, a wallet fix, or a giveaway as hostile.

Running a node safely

The node's JSON-RPC interface binds to loopback by default and is protected by a cookie-file token, not a fixed password. Never expose RPC to the public internet directly; if you need remote access, put an authenticated proxy in front of it rather than opening the port.

How this website protects visitors

This site ships no third-party JavaScript and sets no tracking of any kind. It is served over HTTPS only, with a strict Content Security Policy.