# E13. Development-application configuration analysis

## Source and method

The 24 July analysis used stored response bodies from a research-service capture of a development application dated 25 July 2025. The captured frontend exposed readable source and configuration constants. The principal page bundle is recorded as 32,043,726 bytes with SHA-256 `6fb9559f5706f45bf026eb449ada34706aa42399d3764d35e83d9675c666a66a`. No recovered service credential was used in the follow-up described by the record. [S1]

The deployed frontend response bodies and raw chain-query responses are not retained among these exhibit inputs. Their sizes, hashes and findings below are historical claims from the analysis note. The retained encrypted archive does not independently substantiate them.

## Configuration identity

The deployed bundle and an encrypted environment archive are not proven byte-equivalent. Variable names differ between the example configuration and the captured frontend. Some values are source constants and an RPC value is a fallback used when a build-time value is absent. Reading those constants did not decrypt the archive or establish its contents. [S1]

The captured configuration points to a Solana development network and a local backend address. A commented alternative endpoint does not establish production use. Service keys, wallet identifiers and provider-specific access values are omitted from this report.

## Recorded chain observations

The case record describes follow-up using a researcher-controlled service credential. It reports a development-network program with retained upgrade authority, a deployment on 31 May 2025 and an upgrade on 21 July 2025. The recorded funding of an authority shortly before deployment is consistent with a deployment sequence. It does not establish the person's identity. One funding source was interpreted as shared faucet infrastructure, limiting its attribution value. [S1]

An earlier empty response from a public RPC service was superseded by archival results. An empty result can therefore reflect retention or service coverage, rather than an inactive address. These observations are historical case results and were not repeated for this document.

## Assessment and limits

This is evidence about a separate development application. It is not a recovered backend for the administration wallet console, does not identify that console's recipient addresses, and does not prove mainnet theft. Test-network balances are not victim-loss amounts. The source's stronger operator-control conclusions remain hypotheses requiring corroboration beyond constants and development-network transactions.