trenchcoat
Free · no sign-up
Website report · 29 Oct 2026

app.windle.fun

“Sign in — windle”

AI-written from evidence · anthropic 34 evidence items Code reader analysed 2 scripts
What this means for you

windle's sign-in page asks you to sign in with a Solana wallet, then loads markets, your profile and your portfolio from windle's own API.E1E2E15E16E17

  • The site says you sign a message to prove a Solana address is yours. It also says this message can't move funds.E2
  • The page links to the Phantom and Backpack wallets. We couldn't find the wallet-connection code behind those links, so we can't confirm how it works.E33
  • Once you're signed in, the page asks windle's server for your profile and your portfolio. Those details come from windle's own systems.E16E17
  • One outside service loads on the page: Cloudflare Web Analytics, a page-view counter.E6

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

Nothing found on the public page

Wallet connection

“SIGN IN Returns to app.windle.fun Install Phantom ↗ (opens in a new tab) Install Backpack ↗ (opens in a…”E33

No matching code, calls or services in what loaded for us.

Calls its own backend /v1/markets, /v1/me/portfolio, /v1/meE15E16E17E18
Wallet code none seen
Contract calls in its code none seen
Talks to AI services none seen
Live connections receives a live stream of updates from a serverE14

What it is

  • This is windle's sign-in page. Its main heading is "SIGN IN".E1E3E4
  • The page calls api.windle.fun for markets, your account, your portfolio and your sign-in status.E7E15E16E17E18
  • The code also names a leaderboard, an avatar upload and a media endpoint. We didn't see the page call these during our visit.E22E24E27
  • It is built with React and Remix / React Router, two tools for building web pages. Part of it loads from oauth.windle.fun.E8E9E10
  • The code can copy text to your clipboard. It also includes Three.js, a tool for drawing 3D graphics.E11E12

Where your data goes

Analytics & trackingCount visits and record what you do on the page. 1
static.cloudflareinsights.comCloudflare Web Analytics: page-view counter 2×E6

Crypto and wallets

  • The code names the Solana blockchain. We found no wallet addresses or contract calls in the code.E32
  • The sign-in code names /v1/auth/siws/nonce and /v1/auth/siws/verify. Their names match the wallet-message sign-in the page describes.E2E28E29
  • The sign-in code also names a second route, /v1/auth/x/challenge and /v1/auth/x/verify. We didn't see it used.E30E31

How key features work

Reading the blockchain

The code mentions Solana. We didn't see it read any specific addresses or contracts.E32

Solana

Sign-in and accounts

The page called /v1/auth/session and /v1/auth/providers on windle's API. The code also names /v1/auth/logout for signing out.E18E19E25E26

/v1/auth/session/v1/auth/providers/v1/auth/logout

Live updates

The markets code can receive a live stream of updates from a server. New information can appear without you reloading.E14

event_source

Loading its content

The page fetches markets, your profile, your portfolio and sign-in details from api.windle.fun, windle's own server.E15E16E17E18E19

/v1/markets/v1/me/portfolio/v1/me/v1/auth/session/v1/auth/providers

Drawing and editing in the browser

Code loaded from oauth.windle.fun includes Three.js, which draws 3D graphics in your browser.E11

Three.js (3D graphics)

Measuring what you do

The page loads Cloudflare Web Analytics, a page-view counter, from static.cloudflareinsights.com.E6

Cloudflare Web Analytics

Saving data on your device

The code can save small bits of data in your browser's local storage, a small storage space your browser keeps for each site.E13

local_storage

Pages and API calls

Endpoints

Called while loading (seen) or named in the code (code).

api.windle.fun/v1/marketsseenE15
api.windle.fun/v1/me/portfolioseenE16
api.windle.fun/v1/meseenE17
api.windle.fun/v1/auth/sessionseenE18
api.windle.fun/v1/auth/providersseenE19
/v1/mecodeE20
/v1/me/portfoliocodeE21
/v1/leaderboardcodeE22
/v1/marketscodeE23
/v1/me/avatarcodeE24
/v1/auth/sessioncodeE25
/v1/auth/logoutcodeE26
/v1/mediacodeE27
/v1/auth/siws/noncecodeE28
/v1/auth/siws/verifycodeE29
/v1/auth/x/challengecodeE30
/v1/auth/x/verifycodeE31

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: Sign in — windle
page title · https://app.windle.fun/
E2
Page description: Sign in to windle with your Solana wallet. You sign a message that proves the address is yours. It can't move funds.
page description · https://app.windle.fun/
E3
Site name: windle
page site_name · https://app.windle.fun/
E4
Main heading: SIGN IN
page h1 · https://app.windle.fun/
E5
24 request(s) to app.windle.fun
types: 20 script, 2 font, 1 document
GET https://app.windle.fun/ · script · 24 requests · network recording
E6
2 request(s) to static.cloudflareinsights.com
types: 2 script
GET https://static.cloudflareinsights.com/beacon.min.js/vce701823e78c4301a35b7e07294d87301792088814092 · script · 2 requests · network recording
E7
6 request(s) to api.windle.fun
types: 6 fetch
GET https://api.windle.fun/v1/markets · fetch · 6 requests · network recording
E8
6 request(s) to oauth.windle.fun
types: 2 script, 2 font, 1 document
GET https://oauth.windle.fun/ · script · 6 requests · network recording
E9
React detected by The code reader (react-runtime)
confidence: medium
oauth.windle.fun/assets/index-zJDurN-P.js · “react-runtime” · The code reader analyze-web-bundle 6.4.0
E10
Remix / React Router found in the code
app.windle.fun/assets/compiler-runtime-CqsRyqNR.js @ 4:16465 · “__reactRouterContext” · pattern scan
E11
Three.js (3D graphics) found in the code
oauth.windle.fun/assets/MarkScene-9JaYRX22.js @ 5:147550 · “WebGLRenderer” · pattern scan
E12
Uses the browser ability: clipboard_write
can copy text to your clipboard
app.windle.fun/assets/Amount-CvugGi3Y.js @ 2:60835 · “clipboard.writeText(” · pattern scan
E13
Uses the browser ability: local_storage
saves small bits of data in your browser
app.windle.fun/assets/Amount-CvugGi3Y.js @ 2:74959 · “localStorage.setItem(” · pattern scan
E14
Uses the browser ability: event_source
receives a live stream of updates from a server
app.windle.fun/assets/MarketsHome-DXxZAj6p.js @ 1:41044 · “new EventSource(” · pattern scan
E15
The page called /v1/markets on api.windle.fun (GET)
GET https://api.windle.fun/v1/markets · fetch · network recording
E16
The page called /v1/me/portfolio on api.windle.fun (GET)
GET https://api.windle.fun/v1/me/portfolio · fetch · network recording
E17
The page called /v1/me on api.windle.fun (GET)
GET https://api.windle.fun/v1/me · fetch · network recording
E18
The page called /v1/auth/session on api.windle.fun (GET)
GET https://api.windle.fun/v1/auth/session · fetch · network recording
E19
The page called /v1/auth/providers on api.windle.fun (GET)
GET https://api.windle.fun/v1/auth/providers · fetch · network recording
E20
Code reader found the endpoint /v1/me
how: call:n.get
s04-Amount-CvugGi3Y.js · “/v1/me” · The code reader analyze-javascript-application 6.4.0
E21
Code reader found the endpoint /v1/me/portfolio
how: call:Y.get
s04-Amount-CvugGi3Y.js · “/v1/me/portfolio” · The code reader analyze-javascript-application 6.4.0
E22
Code reader found the endpoint /v1/leaderboard
how: call:Y.get
s04-Amount-CvugGi3Y.js · “/v1/leaderboard” · The code reader analyze-javascript-application 6.4.0
E23
Code reader found the endpoint /v1/markets
how: call:Y.post
s04-Amount-CvugGi3Y.js · “/v1/markets” · The code reader analyze-javascript-application 6.4.0
E24
Code reader found the endpoint /v1/me/avatar
how: call:ue.put
s07-index-CjjOrgEA.js · “/v1/me/avatar” · The code reader analyze-javascript-application 6.4.0
E25
Code reader found the endpoint /v1/auth/session
how: call:n.get
s04-Amount-CvugGi3Y.js · “/v1/auth/session” · The code reader analyze-javascript-application 6.4.0
E26
The code names the endpoint /v1/auth/logout
app.windle.fun/assets/Amount-CvugGi3Y.js @ 2:70552 · “/v1/auth/logout” · pattern scan
E27
The code names the endpoint /v1/media
app.windle.fun/assets/index-CjjOrgEA.js @ 50:176682 · “/v1/media” · pattern scan
E28
The code names the endpoint /v1/auth/siws/nonce
oauth.windle.fun/assets/index-zJDurN-P.js @ 66:63119 · “/v1/auth/siws/nonce” · pattern scan
E29
The code names the endpoint /v1/auth/siws/verify
oauth.windle.fun/assets/index-zJDurN-P.js @ 66:63177 · “/v1/auth/siws/verify” · pattern scan
E30
The code names the endpoint /v1/auth/x/challenge
oauth.windle.fun/assets/index-zJDurN-P.js @ 66:63259 · “/v1/auth/x/challenge” · pattern scan
E31
The code names the endpoint /v1/auth/x/verify
oauth.windle.fun/assets/index-zJDurN-P.js @ 66:63347 · “/v1/auth/x/verify” · pattern scan
E32
Chain in code: Solana
app.windle.fun/assets/src-BfTvxIea.js @ 55:45462 · “solana-mainnet” · pattern scan
E33
The site says: “SIGN IN Returns to app.windle.fun Install Phantom ↗ (opens in a new tab) Install Backpack ↗ (opens in a…”
page text · https://app.windle.fun/ · SIGN IN Returns to app.windle.fun Install Phantom ↗ (opens in a new tab) Install Backpack ↗ (opens in a…
E34
The Internet Archive has no saved copy of app.windle.fun
page web archive · https://web.archive.org/web/*/app.windle.fun

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
  • The tech check compares the site's own words with what its public page loads. Work done on servers, in private code or in separate apps isn't visible here, so 'nothing found' means not visible on the public page, not that it doesn't exist.
  • We only see what your browser loads and sends. What windle's servers do with your data is invisible to us.
  • We couldn't find the code behind the Phantom and Backpack wallet links, so the wallet sign-in isn't confirmed.
  • The code reader hit its size budget on parts of 8 large bundle file(s); those parts weren't fully analysed.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id OCoPvxMs.