Report vulnerabilities privately to maxzoa27@gmail.com. Do not include private keys, seeds,
payment signatures, Telegram tokens or unrelated personal data.
Public security contact: https://1cent.maxzoa.ru/.well-known/security.txt.
Only current production release 0.7.0 and latest main revision receive security fixes.
See CURRENT_PRODUCTION.md for the active runtime contract.
Useful reports include SSRF bypass, DNS rebinding, payment replay/double settlement, idempotency bypass, origin/host validation bypass, secret exposure, authentication bypass and unsafe redirect handling.
Do not perform destructive testing, denial of service, real payment experiments, credential use,
access-control bypass or tests against third-party sites without authorization. Use testnet and
example.com where possible.
- URL work starts only after the payment gate for paid routes.
- Private/link-local/loopback destinations fail closed.
- Raw payment signatures and wallet secrets are not audit fields.
- UNKNOWN settlement has no automatic retry.
- Operational pause occurs before facilitator verify/settle.
- Buyer Bridge is local stdio software, not a seller-side wallet service.
onecent wallet setuses a hidden prompt and OS keyring; no key is written to bridge SQLite.- Environment-based signer injection is supported only for headless buyer processes.
- Bridge validates x402 v2,
exact, Base Mainnet, Base USDC, seller, amount and exact resource. - Manual mode quotes without signing, then consumes one approval bound to exact input/payment terms.
- Auto-pay startup requires explicit network/asset/seller/charge gates and positive local caps.
- Pending/UNKNOWN amounts count against the buyer daily cap; identical UNKNOWN requests are blocked.
- A success requires HTTP 200 plus
PAYMENT-RESPONSE; ambiguous failure is never called unpaid.
- Offer/receipt signing uses a dedicated Ed25519 key, never a seller or buyer key.
- The private key is an untracked read-only runtime secret; only the public
did:webdocument is exposed at/.well-known/did.json. - Offer evidence is attached to unpaid HTTP 402 challenges. Receipt evidence is attached only to a successful payment response.
- Signing failure cannot trigger settlement retry or create a new payment identifier.
See BUYER_BRIDGE.md. Never submit wallet secrets in bug reports.