Information and instructions to the user (Annex II)

Product: COOK version 2.0.0 Manufacturer: Bilal El Homsi Generated: 2026-10-24 by cra-dossier 0.1.0 from the repository cook at commit cd17b114fbab Regulation: Regulation (EU) 2024/2847 (Cyber Resilience Act), OJ L, 2024/2847, 20.11.2024, http://data.europa.eu/eli/reg/2024/2847/oj

DRAFT generated from the repository for the manufacturer to review, complete and sign. This is not legal advice. This document makes no claim that the product conforms to Regulation (EU) 2024/2847 and no claim about CE marking; conformity is declared only by the manufacturer, on its sole responsibility, after completing the human items in the gap list.

Article 13(18): the product is accompanied by this information in paper or electronic form, in a language easily understood by users and market surveillance authorities, kept available for at least 10 years after placing on the market or for the support period, whichever is longer. Publish this text (or a page carrying it) with the product: store listing, website, in-app about screen.

COOK: security information for users

1. Manufacturer (Annex II, point 1; Article 13(16)) Bilal El Homsi, individual developer (sole trader), publisher of record on the Solana dApp Store [HUMAN: postal address] Email: hello@cookkitchen.fun | Website: https://cookkitchen.fun

2. Reporting a vulnerability (Annex II, point 2; Article 13(17)) Single point of contact: hello@cookkitchen.fun. Security reports: hello@cookkitchen.fun. Our coordinated vulnerability disclosure policy: [HUMAN: URL of SECURITY.md or the policy page].

3. Product identification (Annex II, point 3; Article 13(15)) COOK, Android mobile application for the Solana Seeker phone (Expo / React Native), version 2.0.0. npm package name: cook; expo slug: cook; android package: fun.cook.app; android versionCode: 32; gradle applicationId: fun.cook.app; gradle versionName (native project file; a managed build may override it): 0.1.0; gradle versionCode (native project file; a managed build may override it): 1.

4. Intended purpose, security environment, essential functionalities and security properties (Annex II, point 4) COOK lets a Seeker phone owner type a thought or pick a photo, receive an AI-generated meme character with a meme and sticker pack, and, only if the user chooses, launch that character as a Solana meme coin through one of four launch rails (the COOK Kitchen on Meteora's dynamic bonding curve, Pump.fun, Jupiter Studio or Bags). The app never holds private keys: every transaction is signed by the user's Seed Vault wallet through the Solana Mobile Wallet Adapter. It is distributed through the Solana dApp Store to consumers. Essential functionalities: AI character and sticker generation from a prompt or a photo; a name check against existing tokens; coin creation and first buy through the selected rail, signed in the user's wallet; a public feed of coins created in the Kitchen with a grade computed by the COOK worker from on-chain facts; an earnings screen where a creator can claim accrued fees; sharing of generated images. Security environment and properties: Runs on a Solana Seeker (Android) obtained from the Solana dApp Store, which verifies the package signature on install and update. Keys live in the phone's Seed Vault; the app receives signatures only. Network access is over HTTPS to Solana RPC endpoints, the COOK metadata and feed worker (Cloudflare), the launch-rail APIs and an AI model gateway. The user is responsible for the device lock, for keeping the phone and the app updated, and for approving each transaction in the wallet sheet.

5. Circumstances that may lead to significant cybersecurity risks (Annex II, point 5)

• Meme coin launches are speculative by nature; the app shows the fee model and the grade but does not control the market

6. EU declaration of conformity (Annex II, point 6; Article 13(20)) [HUMAN: URL where the signed declaration will be published; until signed, no statement of conformity is made]

7. Security support and support period (Annex II, point 7; Article 13(8) and 13(19)) Type of support: Security updates ship as new builds through the Solana dApp Store at no charge; there is no paid support plan.. End of the support period: [HUMAN: month and year]. Until then, vulnerabilities are handled and security updates provided free of charge.

8. Secure use instructions (Annex II, point 8)

• (a) Initial set-up and ongoing secure use: [HUMAN: for example: install only from the official store; keep the operating system updated; use the device lock]
• (b) How changes to the product can affect the security of data: [HUMAN: what new versions may change, where release notes are published]
• (c) How security updates are installed: Solana dApp Store installs updates automatically when automatic updates are enabled on the device; you can also update manually from the store listing.
• (d) Secure decommissioning and removing your data: [HUMAN: for example: sign out or disconnect in the app, then uninstall; data held on our servers is deleted by ...]
• (e) Turning off automatic security updates: Automatic updates are controlled in the Solana dApp Store client or device settings.
• (f) Integration into other products: [HUMAN: not applicable for an end-user application, or the integrator information]

9. Software bill of materials (Annex II, point 9) The software bill of materials is held with the technical documentation and provided to market surveillance authorities on reasoned request (Annex VII, point 8).