trenchcoat
Free · no sign-up
Website report · 6 h ago

hushenvelope.com

“Hush Envelope — Private SOL”

Template-written 23 evidence items Code reader analysed 1 scripts
What this means for you

hushenvelope.com only talked to its own servers while we watched.E1

  • An AI agent used the site and saw 0 of 1 claimed features working.E19E20
  • A working app / platform: Clicking "Launch app" opened an in-page app view, but it only showed a "Create a new account" form (account name and password) plus "Restore from backup". Going straight to #app/notes showed the same form. The features behind it couldn't be reached without creating an account, which isn't allowed in this test.E19E20
  • Also noticed, Backend calls on page load: When the homepage was reloaded, it made requests to /api/config, /api/pool and a POST to /api/rpc. This shows a backend is responding, but the page displayed no pool data.E22
  • Also noticed, Program address and contract listing: The page lists a Solana mainnet program address (CHjoy7…s3SLp6) with links to Solscan and Solana Explorer. The token contract field reads "Coming soon".E18
  • Tech check: the site claims a working app / platform, and its public page shows matching evidence.E16E8E9E10
  • We saw no known analytics or advertising services load on the first visit.E1

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

Evidence found

A working app / platform

“…OPE Menu [+] Features How it works Protocol Limits X ↗ Launch app YOUR BALANCE. YOUR BUSINESS. HUSHENVELOPE Some things…”E16

Calls to its own backend: /api/config, /api/pool, /api/rpcE8E9E10

Calls its own backend /api/config, /api/pool, /api/rpcE8E9E10
Wallet code none seen
Contract calls in its code none seen
Talks to AI services none seen
Live connections none seen

What the AI agent tried

An AI agent (claude-opus-5-5) used the site in our sandbox for 6 steps and saw 0 of 1 claimed feature working. It can't connect a wallet, pay, sign or log in, so those features count as "couldn't test". What it reports is what it observed, not a verdict.

Couldn't test

A working app / platform

Clicking "Launch app" opened an in-page app view, but it only showed a "Create a new account" form (account name and password) plus "Restore from backup". Going straight to #app/notes showed the same form. The features behind it couldn't be reached without creating an account, which isn't allowed in this test.E19E20

Also noticed

Things the agent saw along the way that aren't among the site's claims. Not counted above.

Noticed

Backend calls on page load

When the homepage was reloaded, it made requests to /api/config, /api/pool and a POST to /api/rpc. This shows a backend is responding, but the page displayed no pool data.E22

Noticed

Program address and contract listing

The page lists a Solana mainnet program address (CHjoy7…s3SLp6) with links to Solscan and Solana Explorer. The token contract field reads "Coming soon".E18

What it is

  • The Internet Archive has never saved this site, so it is probably new.E17
  • The site describes itself as: “Hush Envelope — a private SOL balance, encrypted notes, and browser-held keys on Solana.”E2
  • In your browser it can copy text to your clipboard and runs compiled WebAssembly code in your browser.E5E6
  • While loading, it called 3 endpoints on its own servers, such as /api/config, /api/pool and /api/rpc.E8E9E10

Where your data goes

On a first visit the page only talked to its own servers (hushenvelope.com).

How key features work

Loading its content

Its content loads from its own API while you browse (/api/config, /api/pool and /api/rpc).E8E9E10

/api/config/api/pool/api/rpc

Drawing and editing in the browser

The page draws and edits graphics in your browser using WebAssembly.E6

webassembly

Pages and API calls

Pages it links to

/

Endpoints

Called while loading (seen) or named in the code (code).

hushenvelope.com/api/configseenE8
hushenvelope.com/api/poolseenE9
hushenvelope.com/api/rpcseenE10
/api/configcodeE11
/api/poolcodeE12
/api/relaycodeE13
/api/faucetcodeE14

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: Hush Envelope — Private SOL
page title · https://hushenvelope.com/
E2
Page description: Hush Envelope — a private SOL balance, encrypted notes, and browser-held keys on Solana.
page description · https://hushenvelope.com/
E3
Main heading: HUSH ENVELOPE_
page h1 · https://hushenvelope.com/
E4
11 request(s) to hushenvelope.com
types: 4 fetch, 2 stylesheet, 2 image
GET https://hushenvelope.com/ · fetch · 11 requests · network recording
E5
Uses the browser ability: clipboard_write
can copy text to your clipboard
hushenvelope.com/app.js @ 2144:10767 · “clipboard.writeText(” · pattern scan
E6
Uses the browser ability: webassembly
runs compiled WebAssembly code in your browser
hushenvelope.com/app.js @ 12:1883161 · “WebAssembly.compile(” · pattern scan
E7
Uses the browser ability: web_worker
runs work in a background thread
hushenvelope.com/app.js @ 250:998 · “new Worker(” · pattern scan
E8
The page called /api/config on hushenvelope.com (GET)
GET https://hushenvelope.com/api/config · fetch · network recording
E9
The page called /api/pool on hushenvelope.com (GET)
GET https://hushenvelope.com/api/pool · fetch · network recording
E10
The page called /api/rpc on hushenvelope.com (POST)
POST https://hushenvelope.com/api/rpc · fetch · network recording
E11
Code reader found the endpoint /api/config
how: call:fetch
hushenvelope.com/app.js @ 255:24066 · “/api/config” · the code reader
E12
Code reader found the endpoint /api/pool
how: call:fetch
hushenvelope.com/app.js @ 255:25122 · “/api/pool” · the code reader
E13
The code names the endpoint /api/relay
hushenvelope.com/app.js @ 2144:7300 · “/api/relay” · pattern scan
E14
The code names the endpoint /api/faucet
hushenvelope.com/app.js @ 2144:11143 · “/api/faucet” · pattern scan
E15
1 links to pages on the same site
page links · https://hushenvelope.com/ · /
E16
The site says: “…OPE Menu [+] Features How it works Protocol Limits X ↗ Launch app YOUR BALANCE. YOUR BUSINESS. HUSHENVELOPE Some things…”
page text · https://hushenvelope.com/ · …OPE Menu [+] Features How it works Protocol Limits X ↗ Launch app YOUR BALANCE. YOUR BUSINESS. HUSHENVELOPE Some things…
E17
The Internet Archive has no saved copy of hushenvelope.com
page web archive · https://web.archive.org/web/*/hushenvelope.com
E18
Agent step 1: view
AI agent step 1 · view on /
E19
Agent step 2: click Launch app ↗
AI agent step 2 · click on /
E20
Agent step 3: go /
AI agent step 3 · go on /
E21
Agent step 4: click (not done: No element with that number in the last view.)
AI agent step 4 · click on /
E22
Agent step 5: go /
AI agent step 5 · go on / · page called GET hushenvelope.com/api/config, GET hushenvelope.com/api/pool, POST hushenvelope.com/api/rpc
E23
Agent step 6: click What you see
AI agent step 6 · click on /

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
  • The tech check compares the site's own words with what its public page loads. Work done on servers, in private code or in separate apps isn't visible here, so 'nothing found' means not visible on the public page, not that it doesn't exist.
  • This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.
  • The code reader hit its size budget on parts of 1 large bundle file(s); those parts weren't fully analysed.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id HYPahkAb.