RecheckableGLAM
glam.systems · Other · Solana · data checked 2026-10-20 21:42 (Stockholm)
Contact route: on-chain security.txt (program) ↗
Not claimed Automated from public data
Produced automatically from public data on 2026-10-20 (method v0.2.7). It shows how much of this project’s control structure, code and contact information could be checked from public sources. No person selected or adjusted it, and nothing a project does or pays changes it. It is not a security audit.
Beta: the method is still being calibrated, so this automated score may contain errors. Send a correction.
Transparency score, not a security audit. Scores are generated automatically from public data (Solana RPC, OtterSec build registry, GitHub, project websites). Projects are not involved unless a page is marked “Claimed”, and claiming never changes a score. Nothing here says a project is safe. How scores are made → · Corrections, right of reply & opt-out →
- Onchain: strongest Code openness; weakest Audits; missing data in Code openness, Team & contact.
Something wrong on this page? Dispute a check or send a correction · opt-out. We re-run the check and correct the page.
What was checked: addresses & sources
GLAMpaME8wdTEzxtiYEAa5yD8fZbxZiz2hNtV58RZiEz(program) — source: https://docs.glam.systems/v1/programsGM1NtvvnSXUptTrMCqbogAdZJydZSNv98DoU5AZVLmGh(program) — source: https://docs.glam.systems/v1/programsG1NTcMDYgNLpDwgnrpSZvoSKQuR9NXG7S3DmtNQCDmrK(program) — source: https://docs.glam.systems/v1/programsG1NTkDEUR3pkEqGCKZtmtmVzCUEdYa86pezHkwYbLyde(program) — source: https://docs.glam.systems/v1/programsG1NTsQ36mjPe89HtPYqxKsjY5HmYsDR6CbD2gd2U2pta(program) — source: https://docs.glam.systems/v1/programsgConFzxKL9USmwTdJoeQJvfKmqhJ2CyUaXTyQ8v9TGX(program) — source: https://docs.glam.systems/v1/programspo1iCYakK3gHCLbuju4wGzFowTMpAJxkqK1iwUqMonY(program) — source: https://docs.glam.systems/v1/programs
Website glam.systems · GitHub https://github.com/glamsystems. Addresses are used only if they appear verbatim on an official project page.
Programs taken from the project's own official address list or repository (process v1, docs/program-discovery-process.md); each exists on mainnet as an executable program.
Onchain track
Contract control weight 307.5/30
- ◐ Partial
Upgrade authority GLAMpa…
Upgrade authority is 7fyccm3Pua7dLpNSGL98zRhPK9qHtydYnP9nkMA4GrB: Squads v4 multisig 987uDDRC… with threshold 2 of 3 voting member(s) (5 total), time lock 0 s (established by re-deriving the vault address from the multisig; found in upgrade history tx 3Qn583ho…). Member independence not established. Address taken from official source: https://docs.glam.systems/v1/programsdocs.glam.systems ↗Explorer ↗Explorer ↗Explorer ↗ checked 2026-10-20sha256 06656f857949…sha256 c8d54d30109a…What would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) GLAMpa…
OtterSec registry answered: no build was ever submitted for this program (no submission).What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- ◐ Partial
Upgrade authority GM1Ntv…
Upgrade authority is 7fyccm3Pua7dLpNSGL98zRhPK9qHtydYnP9nkMA4GrB: Squads v4 multisig 987uDDRC… with threshold 2 of 3 voting member(s) (5 total), time lock 0 s (established by re-deriving the vault address from the multisig; found in upgrade history tx 4S2sD9pN…). Member independence not established. Address taken from official source: https://docs.glam.systems/v1/programsdocs.glam.systems ↗Explorer ↗Explorer ↗Explorer ↗ checked 2026-10-20sha256 e3f82ada88d3…sha256 2af31d0c2ecd…What would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) GM1Ntv…
OtterSec registry answered: no build was ever submitted for this program (no submission).What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- ◐ Partial
Upgrade authority G1NTcM…
Upgrade authority is 7fyccm3Pua7dLpNSGL98zRhPK9qHtydYnP9nkMA4GrB: Squads v4 multisig 987uDDRC… with threshold 2 of 3 voting member(s) (5 total), time lock 0 s (established by re-deriving the vault address from the multisig; found in upgrade history tx 2cYiQtBa…). Member independence not established. Address taken from official source: https://docs.glam.systems/v1/programsdocs.glam.systems ↗Explorer ↗Explorer ↗Explorer ↗ checked 2026-10-20sha256 ff65d8d34f9c…sha256 fece1b66a0eb…What would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) G1NTcM…
OtterSec registry answered: no build was ever submitted for this program (no submission).What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- ◐ Partial
Upgrade authority G1NTkD…
Upgrade authority is 7fyccm3Pua7dLpNSGL98zRhPK9qHtydYnP9nkMA4GrB: Squads v4 multisig 987uDDRC… with threshold 2 of 3 voting member(s) (5 total), time lock 0 s (established by re-deriving the vault address from the multisig; found in upgrade history tx 4FKMcpyJ…). Member independence not established. Address taken from official source: https://docs.glam.systems/v1/programsdocs.glam.systems ↗Explorer ↗Explorer ↗Explorer ↗ checked 2026-10-20sha256 26a74ae9f016…sha256 2b880d250cc2…What would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) G1NTkD…
OtterSec registry answered: no build was ever submitted for this program (no submission).What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- ◐ Partial
Upgrade authority G1NTsQ…
Upgrade authority is 7fyccm3Pua7dLpNSGL98zRhPK9qHtydYnP9nkMA4GrB: Squads v4 multisig 987uDDRC… with threshold 2 of 3 voting member(s) (5 total), time lock 0 s (established by re-deriving the vault address from the multisig; found in upgrade history tx 2KgK3t74…). Member independence not established. Address taken from official source: https://docs.glam.systems/v1/programsdocs.glam.systems ↗Explorer ↗Explorer ↗Explorer ↗ checked 2026-10-20sha256 54f8dafa7626…sha256 045773b49fb8…What would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) G1NTsQ…
OtterSec registry answered: no build was ever submitted for this program (no submission).What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- ◐ Partial
Upgrade authority gConFz…
Upgrade authority is 7fyccm3Pua7dLpNSGL98zRhPK9qHtydYnP9nkMA4GrB: Squads v4 multisig 987uDDRC… with threshold 2 of 3 voting member(s) (5 total), time lock 0 s (established by re-deriving the vault address from the multisig; found in upgrade history tx 5KBP2c7b…). Member independence not established. Address taken from official source: https://docs.glam.systems/v1/programsdocs.glam.systems ↗Explorer ↗Explorer ↗Explorer ↗ checked 2026-10-20sha256 d2f1ed56b2cf…sha256 c3e6a54381b5…What would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) gConFz…
OtterSec registry answered: no build was ever submitted for this program (no submission).What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- ◐ Partial
Upgrade authority po1iCY…
Upgrade authority is 7fyccm3Pua7dLpNSGL98zRhPK9qHtydYnP9nkMA4GrB: Squads v4 multisig 987uDDRC… with threshold 2 of 3 voting member(s) (5 total), time lock 0 s (established by re-deriving the vault address from the multisig; found in upgrade history tx 3zM1s3BC…). Member independence not established. Address taken from official source: https://docs.glam.systems/v1/programsdocs.glam.systems ↗Explorer ↗Explorer ↗Explorer ↗ checked 2026-10-20sha256 71c7d073fe9f…sha256 de5a8d194cc3…What would show up as met
- If the program is final, revoke the upgrade authority. It then reads as immutable.
- Otherwise move the authority to a multisig or a DAO. For a multisig, use a threshold of at least 2, add a time lock, and do not keep a separate config authority that can change members without a vote.
- Publish the multisig or DAO address on your own website so the page and the on-chain account can be tied together.
How we check: We read the program’s upgrade authority on Solana (public RPC) and recognise Squads, Serum-style multisigs and SPL Governance accounts. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✕ Not met
Build matches source (OtterSec registry) po1iCY…
OtterSec registry answered: no build was ever submitted for this program (no submission).What would show up as met
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
solana-verify). - Submit the build to the registry so that it appears in the OtterSec registry (verify.osec.io). The check reads that registry; it does not rebuild anything itself.
How we check: We ask the OtterSec build registry (verify.osec.io, a third party) whether the deployed program matches a build from the public source. We report what the registry says; we do not rebuild or vouch for anything ourselves. Any registry entry that matches the program’s current on-chain hash counts, not only the registry’s default entry (method 0.2.5). This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Build the program reproducibly from your public source with the Solana verifiable-build tooling (
- – N/A
Mint/freeze authority
No token mint submitted.source: calculated from the other checks checked 2026-10-20
Audits weight 150/15
- ✕ Not met
Audits found at official sources
No audit found in the sources we searched (GitHub glamsystems: 13 of 13 non-fork repositories file-listed via GitHub API | glam.systems: 18 audit/security page address(es) fetched (docs sub-domains and homepage audit links included)). This is not proof that no audit exists: reports may be hosted elsewhere, e.g. on an auditor's own site. If the project has one, point us to it: info@recheckable.com.GitHub ↗glam.systems ↗api.github.com ↗GitHub ↗ checked 2026-10-20sha256 2c7ca677da65…sha256 4f0a2ccccd28…What would show up as met
- Link each audit report from an official page: your docs, your website or an audits folder in your GitHub repository.
- Tell us the page through the corrections form so it can be added. The check only confirms that the document is reachable. It does not assess the audit’s quality or whether it covers the current code.
How we check: Audit links come from official pages found for the project, not from a search of the web. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
Code openness weight 15 · 1 not read15/15
- ✓ Met
Public repository
glamsystems/glam-sdk-ts public, created 2025-03-18, 3 contributor(s) (count only).GitHub ↗api.github.com ↗api.github.com ↗api.github.com ↗ checked 2026-10-20sha256 f6c4cef8626a…sha256 2bc077468679… - ✓ Met
Licence
SPDX: Apache-2.0.GitHub ↗api.github.com ↗api.github.com ↗api.github.com ↗ checked 2026-10-20sha256 f6c4cef8626a…sha256 2bc077468679… - ✓ Met
Activity last 90 days
Last push 2026-10-18 (2 d ago), latest across the glamsystems organisation's non-fork repositories.GitHub ↗api.github.com ↗api.github.com ↗api.github.com ↗ checked 2026-10-20sha256 f6c4cef8626a…sha256 2bc077468679… - ⊘ Not read
On-chain program source public
Program ID not found in the submitted repo or the security.txt source_code repo. Source may exist elsewhere — counted as unknown, not as closed. Repos searched (shallow clone, text search for the program ID): https://github.com/https://github.com/glamsystems (clone failed), https://github.com/glamsystems/glam (clone failed). Does not prove the deployed binary matches (see the build check). (reason: unreadable)What would show up as met
Nothing for the project to do. Our checker could not read the source this time, so the check is “Not read”: no points are lost. It is tried again at the next run. If you think the data behind it is wrong, send a correction.
Onchain history weight 1010/10
- ✓ Met
Last deploy GLAMpa…
Last deploy 2026-04-10 (193 d ago).Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 06656f857949…sha256 c8d54d30109a… - ○ Not built
Program age / upgrade count GLAMpa…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 06656f857949…sha256 c8d54d30109a… - ✓ Met
Last deploy GM1Ntv…
Last deploy 2026-04-10 (193 d ago).Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 e3f82ada88d3…sha256 2af31d0c2ecd… - ○ Not built
Program age / upgrade count GM1Ntv…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 e3f82ada88d3…sha256 2af31d0c2ecd… - ✓ Met
Last deploy G1NTcM…
Last deploy 2026-04-10 (193 d ago).Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 ff65d8d34f9c…sha256 fece1b66a0eb… - ○ Not built
Program age / upgrade count G1NTcM…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 ff65d8d34f9c…sha256 fece1b66a0eb… - ✓ Met
Last deploy G1NTkD…
Last deploy 2026-04-10 (193 d ago).Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 26a74ae9f016…sha256 2b880d250cc2… - ○ Not built
Program age / upgrade count G1NTkD…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 26a74ae9f016…sha256 2b880d250cc2… - ✓ Met
Last deploy G1NTsQ…
Last deploy 2026-04-10 (193 d ago).Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 54f8dafa7626…sha256 045773b49fb8… - ○ Not built
Program age / upgrade count G1NTsQ…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 54f8dafa7626…sha256 045773b49fb8… - ✓ Met
Last deploy gConFz…
Last deploy 2026-04-10 (193 d ago).Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 d2f1ed56b2cf…sha256 c3e6a54381b5… - ○ Not built
Program age / upgrade count gConFz…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 d2f1ed56b2cf…sha256 c3e6a54381b5… - ✓ Met
Last deploy po1iCY…
Last deploy 2026-04-10 (193 d ago).Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 71c7d073fe9f…sha256 de5a8d194cc3… - ○ Not built
Program age / upgrade count po1iCY…
Full history scan (first deploy, upgrades in 30 d, authority changes) needs an indexer (e.g. Helius); not available on public RPC.Explorer ↗RPC call (getAccountInfo)RPC call (getSignaturesForAddress)RPC call (getTransaction) checked 2026-10-20sha256 71c7d073fe9f…sha256 de5a8d194cc3…
Team & contact weight 15 · 1 unknown10/15
- ✕ Not met
Security contact (security.txt)
No valid security.txt at /.well-known/security.txt or /security.txt (404).What would show up as met
- Publish a text file at https://your-domain/.well-known/security.txt (or /security.txt) with a
Contact:line, for exampleContact: mailto:security@your-domain. - RFC 9116 also asks for an
Expires:line. We look only forContact:, but addExpires:too so the file stays correct.
How we check: We fetch the two standard locations over HTTPS. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- Publish a text file at https://your-domain/.well-known/security.txt (or /security.txt) with a
- ? Unknown
Bug bounty programme linked
No bug-bounty link found on homepage (raw + rendered), sitemap or security.txt. Not checked deeper (docs sites, Immunefi search) — counted as unknown, not as missing. Also checked: Immunefi public list: no active programme matched; GLAMpa… security.txt policy https://gui.glam.systems/vault/disclaimer mentions no bounty, contacts: email: hello@glam.systems; GM1Ntv… security.txt policy https://gui.glam.systems/vault/disclaimer mentions no bounty, contacts: email: hello@glam.systems; G1NTcM… security.txt policy https://gui.glam.systems/vault/disclaimer mentions no bounty, contacts: email: hello@glam.systems; G1NTkD… security.txt policy https://gui.glam.systems/vault/disclaimer mentions no bounty, contacts: email: hello@glam.systems; G1NTsQ… security.txt policy https://gui.glam.systems/vault/disclaimer mentions no bounty, contacts: email: hello@glam.systems; gConFz… security.txt policy https://gui.glam.systems/vault/disclaimer mentions no bounty, contacts: email: hello@glam.systems; po1iCY… security.txt policy https://gui.glam.systems/vault/disclaimer mentions no bounty, contacts: email: hello@glam.systems.glam.systems ↗glam.systems ↗glam.systems ↗glam.systems ↗ checked 2026-10-20sha256 927c041e9196…sha256 62b6eec5bc82…What would show up as met
- Link your bug bounty (for example an Immunefi, HackerOne or Cantina page, or a /bug-bounty page of your own) from the homepage, the sitemap or your security.txt.
- “Unknown” here means we found no link. It does not mean you have no programme.
How we check: We look at the homepage links (also as rendered in a browser), sitemap.xml and security.txt, and at Immunefi’s public list for on-chain security.txt names. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ℹ Status only
Claimed / not claimed
Status only, not scored: claiming proves control of an authority, domain or GitHub organisation and never changes a score. The status is shown in the page header.source: calculated from the other checks checked 2026-10-20 - ○ Not built
Team declared (voluntary, with consent)
Team declaration + consent flow not built — excluded.source: calculated from the other checks checked 2026-10-20 - ℹ Status only
Components declared complete by the project
Status only, not scored (it used to be scored, which made pages that are not claimed systematically lower; removed 2026-10-15). Other programs/packages may exist that were not submitted.source: calculated from the other checks checked 2026-10-20 - ✓ Met
Program embeds security.txt
7/7 own program(s) embed a solana-security-txt block with contacts (GLAMpa…, GM1Ntv…, G1NTcM…, G1NTkD…, G1NTsQ…, gConFz…, po1iCY…). - ✓ Met
Official program address list
GLAMpa… published on project domain (https://docs.glam.systems/v1/programs); GM1Ntv… published on project domain (https://docs.glam.systems/v1/programs); G1NTcM… published on project domain (https://docs.glam.systems/v1/programs); G1NTkD… published on project domain (https://docs.glam.systems/v1/programs); G1NTsQ… published on project domain (https://docs.glam.systems/v1/programs); gConFz… published on project domain (https://docs.glam.systems/v1/programs); po1iCY… published on project domain (https://docs.glam.systems/v1/programs).
Legal documents weight 1010/10
- ✓ Met
Terms & privacy policy present
Terms: https://glam.systems/terms-and-conditions; privacy: https://glam.systems/privacy-policy (homepage links, sitemap.xml, common paths). Content not assessed.glam.systems ↗glam.systems ↗glam.systems ↗glam.systems ↗ checked 2026-10-20sha256 927c041e9196…sha256 62b6eec5bc82… - ○ Not built
Registered legal entity
Not stated.source: calculated from the other checks checked 2026-10-20 - ✓ Met
Legal entity named in terms
Terms/privacy text names “Lamport Systems, Inc” (https://glam.systems/terms-and-conditions). Not checked against a company registry.
Domain weight 54.4/5
- ✓ Met
HTTPS
https://glam.systems answered HTTP 200 over TLS.glam.systems ↗glam.systems ↗glam.systems ↗glam.systems ↗ checked 2026-10-20sha256 927c041e9196…sha256 62b6eec5bc82… - ◐ Partial
Security headers
Present: HSTS. Missing: CSP, X-Content-Type-Options, X-Frame-Options.glam.systems ↗glam.systems ↗glam.systems ↗glam.systems ↗ checked 2026-10-20sha256 927c041e9196…sha256 62b6eec5bc82…What would show up as met
- Send these four response headers on your homepage: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options and X-Frame-Options.
- The check looks only at whether each header is present, not how strict it is.
How we check: We read the headers of one homepage request. This is what the check looks for. It makes no promise about a score or grade, and claiming or paying never changes a score.
- ✓ Met
Domain age
Registered 2024-01-16 (~1008 d), source: RDAP (rdap.org). Registrant data ignored. - ✓ Met
Domain ↔ components consistency
Linked: address GLAMpa… published on glam.systems (https://docs.glam.systems/v1/programs); address GM1Ntv… published on glam.systems (https://docs.glam.systems/v1/programs); address G1NTcM… published on glam.systems (https://docs.glam.systems/v1/programs); address G1NTkD… published on glam.systems (https://docs.glam.systems/v1/programs); address G1NTsQ… published on glam.systems (https://docs.glam.systems/v1/programs); address gConFz… published on glam.systems (https://docs.glam.systems/v1/programs); address po1iCY… published on glam.systems (https://docs.glam.systems/v1/programs); GitHub org name matches domain (weak)source: calculated from the other checks checked 2026-10-20
Snapshot hash of monitored fields: 751ad62d6ef1287e
AI summaries
Generated with Grok 4.7 (xAI), Claude sonnet-5-5 (Anthropic) and GPT-6.1-sol (OpenAI) via their APIs. xAI, Anthropic and OpenAI have not reviewed, approved or sponsored Recheckable. AI-generated text; models see only extracted check results, never project-supplied text or personal names. They do not affect the score. Some text on this site (summaries and reports) is AI-generated and labelled where it appears. Scores and check results come from fixed code, not from AI. Scores are produced automatically from public data and are not reviewed by hand before they are shown; cases that the automatic checks flag are held for a person.
Template summary (deterministic)
Onchain track: band C (55/100, coverage 94 %, onchain v0.2.7). Strongest: Code openness, Onchain history, Legal documents, Domain. Weakest: Contract control, Audits. 1 check(s) unknown (each costs 1.5 points); 1 not read (no points lost, lowers coverage); 9 not built yet (excluded).
Regulatory information
The project has not declared any regulated-activity types, so no rules are listed.
Law firms (free listing, alphabetical, no ranking)
- Delphi — Stockholm, Blockchain law (self-described)
- Gernandt & Danielsson — Stockholm, Fintech (self-described)
- Magnusson — Stockholm, Fintech (self-described)
- Mannheimer Swartling — Stockholm, Fintech (own practice page to be confirmed) (self-described)
- Setterwalls — Stockholm, Fintech (self-described)
- Vinge — Stockholm, MiCA (own practice page to be confirmed) (self-described)
Recheckable has no financial relationship with the listed firms and receives no fee per contact. Paid placements, if ever introduced, are marked “Ad” and never shown next to low scores.
Score history
Automated score at each published review, newest on the right. The line steps at the date of a review; between reviews the score is unchanged.
Solid line: offchain track. Dashed line: onchain track. ◆ = the method changed at that review.
◆ 2026-10-17: the scoring method changed from v0.2.1 to v0.2.5. A score change at that point can come from the method and not from the project.
◆ 2026-10-19: the scoring method changed from v0.2.5 to v0.2.6. A score change at that point can come from the method and not from the project.
◆ 2026-10-20: the scoring method changed from v0.2.6 to v0.2.7. A score change at that point can come from the method and not from the project.
Data table
| Review | Track | Score | Grade | Coverage | Method |
|---|---|---|---|---|---|
| 2026-10-16 | offchain | 91/100 | A | 75 % | v0.2.1 |
| 2026-10-16 | onchain | 55/100 | C | 94 % | v0.2.1 |
| 2026-10-17 | onchain | 55/100 | C | 94 % | v0.2.5 |
| 2026-10-19 | onchain | 55/100 | C | 94 % | v0.2.6 |
| 2026-10-20 | onchain | 55/100 | C | 94 % | v0.2.6 |
| 2026-10-20 | onchain | 55/100 | C | 94 % | v0.2.7 |
No check changed its result between the published reviews.
History
- 2026-10-20 21:42Forced fresh run (same result; fresh evidence snapshots): onchain C (55, coverage 94 %)
- 2026-10-20 12:56Forced fresh run (same result; fresh evidence snapshots): onchain C (55, coverage 94 %)
- 2026-10-19 12:33Forced fresh run (same result; fresh evidence snapshots): onchain C (55, coverage 94 %)
- 2026-10-17 05:59Nightly re-run: onchain C (55, coverage 94 %)
- 2026-10-16 14:20Nightly re-run: onchain C (55, coverage 94 %)
- 2026-10-16 12:57Initial automatic review (indexed): offchain A (91, coverage 75 %)
Project's own statements and reply
Does your team control the upgrade authority, official domain or GitHub organisation of this project? Claim this page (free, about a minute; it never changes a score).
For project owners: badge
Status: Active. The badge says “no changes since review”, never “safe”.
Badges are for claimed projects. The embed code is available after the page has been claimed (free, about a minute; claiming never changes the score). Claim this page
Re-checks are rate-limited (once per 10 minutes). Restoring a grey badge requires a full review.