Security at Agent402.

Open a private advisory on GitHub or email mike@agent402.tools. We acknowledge within two business days, fix through the same CI pipeline every change goes through, and note the fix in the changelog once it has shipped.

Good-faith research inside the scope below will not be met with legal action. Scope: agent402.tools, the /mcp connector, the /v1 gateway, the x402 and MPP paywall on every paid route, the prepaid credits gate, the card front door (/reports, /monitors, /credits, the Stripe webhook) and the published packages. Out of scope: the payment protocols themselves, third-party facilitators and chains, and volumetric denial of service.

No accounts and no passwords. Agents pay per call from their own wallets; what we keep is the wallet address and transaction id, both already public on-chain. A card purchase leaves the email Stripe collected, the session id, the input and the finished report, held while the report link or subscription is live. Wallet-keyed memory belongs to its owner and lives until they delete it. Free email alerts send a signed confirmation link to the address given, delete an unconfirmed signup after three days, and drop an address the moment it unsubscribes.

Operational logs carry request paths and status codes for days, not months. The full inventory, retention per class and the erasure path are in the privacy policy.

Payments on the crypto rails are non-custodial: buyers sign with their own keys, settlement goes to a public treasury address, and no customer key ever reaches the server. One card path is not, and we say so rather than let the word cover it: a prepaid credits balance is money we hold until it is spent (credits are no longer sold; keys already issued keep spending). A card report is an ordinary card charge: taken at checkout, and refunded to the card automatically if the report fails to generate. The wallets the service spends from are dedicated, low-balance and alarmed; the treasury never signs a request. Production secrets live only in the hosting platform's variable store, are never committed, and CI signing and publishing keys are scoped Actions secrets with npm publishing on OIDC provenance. Links we email (confirmations, unsubscribes, monitor management) are HMAC-signed with dedicated secrets and verified in constant time.

Every tool that fetches a caller-supplied URL goes through a DNS-pinned SSRF guard that refuses private, link-local and metadata addresses and re-validates on redirects; the headless browser runs in a separate secretless worker behind the same egress guard. The free tier is a signed, single-use, slug-scoped proof-of-work token. Settlement runs after the handler, so on x402 an error is not charged, and a settled receipt that arrives on a failed response is ledgered as a debt with an on-chain proof step before any refund leaves. Per-IP and shared rate limits fail closed; a wallet blocklist is enforced before settlement; every response carries a strict content security policy, HSTS and no inline scripts.

The server is open source under AGPL-3.0, so every control on this page can be read. Every pull request runs CodeQL, gitleaks secret scanning with a planted-canary self-check, Socket dependency review and the full test lanes, and every one is a required check before merge; outside contributions also need DCO sign-off and the maintainer's code-owner review on the payment, gating and CI paths; every GitHub Action is pinned to a full commit SHA; the container image is pinned by digest and runs as a non-root user.

Uptime is measured from outside production by two independent observers on separate infrastructure, and the status page renders only what they observed: a day with no observation is shown as no data, never as uptime. A real-money canary buys through every on-chain payment rail daily. Backups of the data volume go offsite nightly with bounded retention.