How MEKU works under the hood.

React 19 with file-based routing and server functions, server-rendered for a fast first paint and hydrated into a single-page app. Routes are code-split and preloaded on intent, so navigation is near-instant. Animation is spring-based and capped to compositor-only properties to hold 60 FPS on mid-range phones; everything respects the reduced-motion preference and the in-app Reduce motion toggle.

The app is deployed to an edge runtime, so HTML and server functions execute close to the user. Static assets are immutable and fingerprinted; images use responsive sizes with lazy loading below the fold. Metadata, canonical URLs, JSON-LD and the sitemap are generated per route rather than injected client-side.

Postgres. Profiles, posts, comments, likes, bookmarks, follows, direct messages, notifications, reports, wallets and transaction records each live in their own table with foreign keys and generated timestamps. Counters (likes, replies, views) are maintained by triggers rather than recomputed on read, and post impressions are deduplicated per viewer.

Row-level security is enabled on every table, with policies scoped to the authenticated user. Privileged checks — roles, verification changes, PIN state — run inside security-definer functions that assert the caller's identity internally, so a client can never assert its own privileges. Roles live in a dedicated table, never on the profile row, which rules out the classic privilege-escalation path.

Email/password auth with server-side session validation. Sessions are listable and individually revocable from Settings → Security. Server functions that touch money require a verified bearer token; unauthenticated calls are rejected before any handler logic runs.

Circle developer-controlled wallets on Arc, provisioned per user from a single wallet set. Private key material never touches the browser. Signing happens server-side and only after the submitted PIN verifies against a PBKDF2-SHA256 hash with a per-user salt; the iteration count is stored alongside the hash so it can be raised without invalidating existing users. Failed attempts increment a server-side lockout counter with exponential cool-down, so brute force is rate-limited by the server, not the client.

Every transfer is validated before submission: EIP-55 checksum on the destination, balance and fee headroom check, and a duplicate-submission guard. State is reconciled two ways — an optimistic local record plus a Circle webhook whose signature is verified before it can mutate anything. Activity distinguishes tips from transfers and resolves counterparties to usernames when both sides are MEKU accounts.

Third-party sites render in a sandboxed frame with an EIP-1193 provider injected at document start. Navigation and asset fetches pass through a server proxy that enforces SSRF guards (no private ranges, no redirects off-origin), per-client rate limits, response-size caps and phishing screening; RPC traffic is scoped to Arc endpoints only. Because modern bundlers resolve chunks against the page origin, assets are re-served on MEKU's origin at their upstream paths and tagged with an origin marker so each frame's requests resolve to the right upstream. Wallet requests from a page can read your address and ask for a signature — they can never sign; that always returns to the native PIN sheet.

Avatars, banners and post images go to object storage and are served through short-lived signed URLs. Protected assets disable context menu, drag and long-press saving on the client. This deters casual copying; it is not, and cannot be, DRM.

Direct messages, typing indicators, reactions and notification counts ride a websocket channel with per-conversation authorization checked server-side on subscribe. Presence and typing state are ephemeral and never persisted.

MEKU exposes a small Model Context Protocol server so approved agents can read a profile, list the feed or notifications, and create a post on the user's behalf. Each tool runs with the calling user's own permissions — the same RLS policies apply — and money movement is deliberately excluded.

Server functions emit structured logs with request IDs; client errors are captured with stack traces and route context. Slow queries and rate-limit trips are tracked so proxy and database limits can be tuned against real traffic rather than guesses.

MEKU runs against Arc testnet infrastructure. Swap and bridge are built but gated until the integration is production-ready. Captcha-protected sites may refuse to run inside any in-app browser, including ours. Legacy PIN hashes created with a higher iteration count than the current runtime allows must be reset once from Settings → Security.