Report a vulnerability
Contact contact@spendpreflight.com with a minimal, redacted reproduction and expected versus observed behavior. Do not send private keys, wallet secrets or customer data. Machine-readable security contact. No bounty or response-time guarantee is offered.
Read-only observations
Tools do not take custody of funds or sign the payment being evaluated. Paid API access uses a separate x402 authorization. Public endpoint checks apply URL, DNS, robots and host-pacing constraints; do not submit private URLs or credentials.
Receipts and keys
Signed receipts bind an observation to an issuer key. They do not establish legal ownership or finality. Check the published key set, key status and the receipt’s scope.
Inspect public code
MIT JavaScript SDK · MIT x402 Lint Action. Open-source clients do not imply that all service code is public or independently audited.