zeekay 6002e1e57d fix(brand): the mark reads, and the app talks only to us ...

The top-left carried a placeholder: a rounded rect and the words "Lux Safe"
set in Inter, forced into a 24x24 box that stretched it into a smudge. The
real LUX wordmark is vector artwork and has been all along, in @luxfi/logo —
so logo.svg, mark.svg, the favicon and the PWA icons now carry it, letterboxed
into the square slots and never stretched. A wide slot gets the horizontal
lockup at its own proportions; the collapsed sidebar rail keeps the square.

Three services this app called belong to Safe Labs, not to us. The Zodiac
check ran on every dashboard load, sent the chain and address of the Safe our
user was looking at, and was refused by CORS — the answer was always "not
affected", so the only thing the request accomplished was the disclosure. The
third-party-cookie probe mounted a hidden frame on someone else's origin. The
transaction builder opened their page inside our frame under our name. Each is
now a brand address, and a brand that publishes none asks nobody. The service
worker's gateway and the WalletConnect app record follow the brand too.

The connect modal also carried "powered by thirdweb" — vendored inside
@web3-onboard/core with no option to turn it off. The patch that already lives
here for getEns now also unmounts that link and empties the wordmark it drew,
so it is not in the DOM and not in the bundle.

2026-08-13 14:38:10 -07:00

..

patches

fix(brand): the mark reads, and the app talks only to us

2026-08-13 14:38:10 -07:00