We take security seriously at paygate-402. If you discover a security vulnerability, please report it responsibly.

DO NOT open a public GitHub issue for security vulnerabilities.

Instead, please email security concerns to: security@x402.org

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes

Private Key Protection:

# NEVER commit private keys
echo "X402_PRIVATE_KEY=*" >> .gitignore

# Use environment variables
export X402_PRIVATE_KEY=your_key_here

# Or use encrypted storage
paygate-402 wallet --encrypt

Wallet Recommendations:

• Use a dedicated wallet for API earnings
• Regularly withdraw to cold storage
• Enable wallet monitoring alerts
• Consider using a multisig for high-value APIs

Secure your x402.config.json:

{
  "payment": {
    "wallet": "0x...",
    "facilitator": "https://x402.org/facilitator"
  }
}

Never include in config:

• Private keys
• API secrets
• Database credentials
• Third-party API keys

Environment Variables:

# Required
X402_WALLET=0xYourWallet

# Optional but sensitive - use platform secrets
X402_PRIVATE_KEY=<use platform secret manager>
RAILWAY_TOKEN=<use platform secret manager>

Platform Secret Management:

Always verify payments properly:

// GOOD - Verify via facilitator
const verified = await verifyPayment({
  paymentHeader: req.headers['x-payment'],
  expectedPrice: '$0.01',
  network: 'eip155:8453',
  facilitatorUrl: 'https://x402.org/facilitator'
});

if (!verified.valid) {
  return res.status(402).json({ error: 'Invalid payment' });
}

// BAD - Trusting payment without verification
const payment = JSON.parse(atob(req.headers['x-payment']));
// DON'T DO THIS - No verification!

Protect against abuse:

{
  "pricing": {
    "routes": {
      "POST /api/expensive": {
        "price": "$0.10",
        "rateLimit": {
          "requests": 100,
          "window": "1h"
        }
      }
    }
  }
}

Always validate input data:

app.post('/api/data', (req, res) => {
  const schema = z.object({
    symbol: z.string().max(10).regex(/^[A-Z]+$/),
    amount: z.number().positive().max(1000000)
  });

  const result = schema.safeParse(req.body);
  if (!result.success) {
    return res.status(400).json({ error: 'Invalid input' });
  }

  // Process validated data
});

The x402 payment header is cryptographically signed. Tampering is detected during verification. Always use the official verification flow.

Payments include nonces and expiration times. The facilitator tracks used payments to prevent replays.

Prices are defined server-side in x402.config.json. Clients cannot change prices - they can only choose whether to pay.

• Always use HTTPS in production
• Use trusted RPC providers
• Monitor for unusual activity

Before deploying to production:

• Private keys not in source code
• x402.config.json doesn't contain secrets
• Using HTTPS
• Rate limiting enabled
• Input validation on all endpoints
• Payment verification via facilitator
• Logging enabled for audit trail
• Monitoring and alerting set up
• Regular dependency updates

Security updates are released as patch versions. Keep your installation up to date:

npm update -g @user/paygate-402

Subscribe to security notifications:

• Watch the GitHub repository
• Follow @x402protocol

We thank security researchers who have responsibly disclosed vulnerabilities:

(No disclosures yet)

• Security Issues: security@x402.org
• General Support: support@x402.org
• GitHub: github.com/user/universal-crypto-mcp

If you discover a security issue, please report it responsibly:

1. Do NOT open a public issue
2. Email the maintainer or open a private security advisory on GitHub
3. Include steps to reproduce the vulnerability
4. Allow reasonable time for a fix before disclosure