A dated record of changes to Trench: the launchpad, Trench Score, fees, rewards and security. The thesis is the promise; this is the receipt. Newest first.
November 4, 2026
Sign in with your wallet, in one signature
Signing in is now two clear choices. Connect wallet signs you in with a single message from Phantom, Solflare, Backpack or Ledger, with no email and no password. Email or social still uses email, Google, Apple or GitHub. Either way an embedded Trench wallet is created for your account, so you can trade and run orders without a browser extension.
Under Account → Wallets you can also link a self-hosted wallet you hold outside any extension: sign one message offline with its keypair and paste the signature. The message names the site and expires, so it can't be replayed, and Trench never sees a private key on any of these paths.
November 4, 2026
Early-dev launch promo
A new creator's first four Trench launches now pay the creator eighty-five percent of the partner trading fee instead of forty, on a separate public config. In plain terms, the creator keeps about sixty-eight cents of every fee dollar; Meteora still takes its twenty, and the remaining twelve funds holder and bagworker rewards and Trench. It is a trial to earn a dev's first look off the incumbent, counted per account, and the fifth launch onward uses the standard config. See the thesis for the full fee breakdown.
Promo config, verifiable on any Solana explorer: GqidKBkT5ugdUWvdxK3FirCLJLxLe2Qp2PSioWub91hH. It is identical to the standard config except for the creator's fee share.
November 3, 2026
Security hardening
An end-to-end security review of the launchpad, the API, the tunnel and the server, with the fixes shipped the same night:
- Coin logos and metadata are write-once: once a coin is live, its details are locked, and before launch only the wallet that first uploaded them can change them. Logos are restricted to real image files.
- Per-client rate limits across the API, Trench Score and the live streams, so no one client can overload the platform.
- Server-side fetches of creator-supplied links are restricted to public internet hosts, so the platform cannot be pointed at anything on the private network.
- The internet-facing and transaction-signing services were moved to a restricted, low-privilege account that cannot read any wallet keys.
- Wallet-link requests now name the site and expire, so a signature collected elsewhere cannot be replayed. Security headers added across the site.
Trench remains non-custodial throughout. No keys ever left the server, and the review made no writes to production.