visitor@phpnet.xyz:~ [sealed] $ phpnet verify --this-tab █
A website that stays safe even when its server is hacked.
Your team signs every release. Every visitor's browser checks every file against that signature and refuses anything else, before it runs.
Same day, the web stack cracked open.
hosts got popped. Railway: an attacker may have read and decrypted customer
env vars. Roll everything; deploys paused. (disclosure)
runtimes got patched. Node.js security releases, incl. a Brotli decoder bug that
permits RCE, CVE-2026-111497. (nodejs.org)
php research flooded in. CVE-2026-109618 / 109619. Agencies said patch now (CISA).
Independent research (J4ck3LSyN, "PHP up 2026") pushes back on
the early RCE claims: a medium memory-safety bug, not code exec.
Small teams get burned in the gap between the leak and the patch.
Your dapp front end is still one swapped script away from a drainer.
Ledger Connect Kit (2023) and BadgerDAO (2021) went exactly that way.
We made that not matter. A sealed release can't be silently swapped while
servers scramble to patch. Its signing keys never live on the server, the
host or its env vars. And the verifier is free, not a subscription perk.
// asking the verifier in your browser…
The server has really swapped one sealed script, /tamper-test/wallet-widget.js, for a fake "drainer". The fake is harmless: no wallet code, it only writes a line to the console. Press the button and watch your browser refuse it.
// how it works
npx entropynet seal ./dist hashes every file into a manifest with one root hash, stamped with a beacon round.
2 of 3 team keys sign it, on their own machines. The release is written to Solana in a memo, so it's public and can't be backdated.
A small verifier in every visitor's browser checks each page, script and style against the signed manifest, and blocks anything that doesn't match.
// threat model
attacker has sealed site ─────────────────────────────────── ───────────────────────────────────────── your web server (php, node, nginx) swapped files are blocked in the browser your host account or its env vars can't sign: seal keys are never stored there a stolen deploy / CI token can deploy, can't sign, so visitors block it 1 of your 3 signing keys still short of the 2-of-3 threshold your DNS on a visitor's first visit not covered: first visit is trust-on-first-use 2 of your 3 signing keys not covered: that's the threshold
// tamper feed
// loading
// seal your own site
npx entropynet seal ./dist --uri https://your.site npx entropynet sign ./dist --key ~/keys/alice.json // on alice's machine npx entropynet sign ./dist --key ~/keys/bob.json // on bob's machine npx entropynet anchor ./dist --payer devnet-payer.json // solana devnet in v1 npx entropynet verify ./dist
// the beacon
Public randomness, every 3 seconds. Anyone can check it. Nobody can predict it. It timestamps every sealed release and times fair launches.
// what it does
Every round, five nodes each lock in a secret number by publishing only its hash. They can't change it later.
On the next tick they reveal. The beacon checks each reveal against its hash, mixes them with a fresh finalized Solana block hash and the previous round.
The result is signed with the beacon's ed25519 key and linked to the round before it. Change any round and every later one breaks.
// round stream
// why launches need it
The creator picks a window, like "sometime in the next 10 minutes". A beacon round picks the moment. Nobody knows it in advance, not even the creator.
Optional raffle: people sign up before the window opens, and the round that fires draws a winner who gets a head-start buy button. The creator can't pick a friend.
Every launch gets a public receipt naming the rounds that decided it, with the math, so anyone can re-run it.
// loading
// paste a site. we fetch its seal manifest, signer policy and a few live files (plain GETs, nothing else)
// your page lives at phpnet.xyz/s/<slug>. its code is our sealed 2-of-3 release + browser verifier; its content is signed by your wallet. 5 pages an hour per ip, slugs belong to the first wallet.
SEALED means: a signed entropynet-seal/v1 manifest at /seal/release.json meets the 2-of-3 style threshold of the signer policy at /seal/policy.json, the release id is recorded on Solana, and the live index and main scripts hash to what was sealed. It is not a promise the site is "hack-proof" — it says the code you get is the code its team signed. NOT SEALED means missing seal, bad signatures, no on-chain record, a hash mismatch, or unreachable. No vulnerability scanning, no probing.
// pick a round, or press verify for the latest one
Nothing here trusts our server. Your browser downloads the round and the round before it, re-hashes every reveal, rebuilds the signed message and checks the ed25519 signature against the beacon key pinned in this page.
// base url: https://phpnet.xyz GET /api/round/latest // newest round GET /api/check?url= // is a site sealed? passive, cached 60s GET /api/site?slug= // a sealed coin page (creator-signed) GET /api/round/:n // one round, immutable GET /api/round/info // public key, period, genesis, message format GET /api/launch // launch board GET /api/launch/:id // one launch + its entropy receipt // verify by hand commit_i = sha256(reveal_i) mix = sha256(reveal_1 ‖ … ‖ reveal_5) message = "entropynet/v1|round|prev_round|prev_randomness|mix|slot|blockhash|time" randomness = sha256(message) signature = ed25519(message + "|" + randomness) beacon key = … // source, spec and ci github.com/nostalgicgarethdev/entropynet
…
What is a sealed front-end?
A website whose files are signed by its team. Your browser checks every page, script and style against that signed list and refuses anything else. If someone hacks the server and swaps in a drainer, your browser won't run it.
Why does this matter now?
On Oct 21, 2026 the web stack got hit on several fronts at once. Railway said an attacker may have accessed and decrypted customer environment variables, and paused deployments (disclosure). Node.js shipped security releases, including CVE-2026-111497, a Brotli decoder bug that permits remote code execution (nodejs.org). And PHP's CVE-2026-109618 / 109619 drew urgent patch advisories (CISA), while independent research (J4ck3LSyN, "PHP up 2026") argues the real issue is a medium-severity memory-safety bug, not code execution. Whatever the final verdict, servers spend days in the gap between leak and patch. A sealed front end can't be silently swapped during that gap. entropynet doesn't patch PHP or Node; patch them.
What if my host or CI gets hacked?
That's the case this is built for. Releases are signed by 2 of 3 team keys that live on the team's own machines. They are never stored on the hosting platform, in its env vars, or in CI. Someone with a stolen deploy token can push files, but they can't sign them, so every visitor's browser blocks them. The release script refuses to run where VERCEL, CI or RAILWAY_ENVIRONMENT is set.
What does the beacon have to do with it?
Each release is stamped with a beacon round, and the newest release is chained into every round after it. That fixes when it was sealed. It's also on-theme: Node's CVE-2026-106074 made randomUUID() and randomInt() repeat the same values in every process started from a snapshot. A public beacon exists so repeated or rigged randomness gets caught.
Is my first visit protected?
Not fully. On your very first visit the verifier isn't installed yet, so you trust whatever the server sends that one time (trust on first use). From then on it's pinned: the signer keys are built into the verifier, and any new release needs 2 of 3 of them. A browser extension that ships the keys ahead of time is the next level.
What if they replace the verifier itself?
Browsers re-check the service worker file now and then, and the verifier checks /sw.js against the sealed release every minute and raises the alarm if it changed. It can't stop its own replacement, which is another reason the extension is on the roadmap.
What happens on a mismatch?
The file is stopped before it runs, the tab shows a block screen, and your browser posts signed evidence to the public tamper feed. Reports from the tamper test are labelled [test].
Is the tamper test safe?
Yes. The swapped file is a fake "drainer" with no wallet code. It only sets a line of text. It's there to show the block working.
Where is the release recorded?
In a Solana memo transaction with the release id, root hash, beacon round and manifest address. v1 uses devnet. Mainnet is a config switch and is off.
What is a randomness beacon?
A public service that puts out a fresh random number on a fixed schedule. Everyone sees the same number at the same time, and anyone can check it wasn't rigged.
Why can't the beacon cheat?
Each node locks its secret in with a hash one round early, so it can't swap it after seeing the others. A finalized Solana block hash goes in too, which nobody controls. Every round is signed and chained to the last, so history can't be quietly rewritten.
Who runs the nodes?
Right now, five nodes run by PHPNET. The commit-reveal and the Solana block hash are there so you don't have to take our word for it. Outside node operators are next.
How does a fair launch work?
You set a window, say "opens in 5 minutes, lasts 10", connect your wallet and add an image. During the window, every beacon round (every 3 seconds) has a chance to fire. The first round that fires is the launch moment. Nobody can know it in advance, including you. Your page then asks your wallet to sign the pump.fun create, and you have 2 minutes to approve. The receipt shows which round fired and how many seconds after it the coin landed.
What's the first-buy raffle?
People drop their wallet before the window opens. The round that fires also draws one winner. When the coin is live, the winner gets a buy button on the receipt that builds a buy for their own wallet to sign and pay. It's a head start, not a lock: pump.fun is open to everyone, so we can't stop others buying at the same time.
Are launches real?
Yes. A live launch creates a real coin on pump.fun. Your own wallet signs and pays for it in your browser; PHPNET never holds a key or your SOL. Your coin's metadata and image go to IPFS through pump.fun.
Who signs and pays?
You do. The server only builds the unsigned transaction and checks it in a simulation. The coin's mint key is made in your browser and never leaves it. Your wallet shows the transaction before you approve.
What if I miss the moment?
If the create doesn't land within 2 minutes of the beacon firing, the launch is marked missed. You can still launch on pump.fun yourself, but it won't carry an entropynet receipt.
Does it cost anything?
The beacon and the API are free. A launch costs the usual pump.fun rent and network fees, about 0.02 SOL, from your wallet, plus any first buy you add. entropynet takes no fee.
Can I use the beacon for my own thing?
Yes. Raffles, giveaways, game seeds, picking winners. Read /api/round/latest and point people to the verifier.