Paygate moves real money on behalf of autonomous agents, so we take security seriously.

Please do not open a public issue for security problems.

Report privately via GitHub Security Advisories (preferred) or by email to the maintainer. Include:

• a description and impact assessment,
• steps to reproduce (a proof of concept if possible),
• affected package/version or commit.

We aim to acknowledge reports within 72 hours and to ship a fix or mitigation for confirmed high-severity issues promptly. We'll credit reporters who wish to be named once a fix is released.

• Payment verification (apps/server/src/gateway/verify.ts) — signature binding, single-use nonce consumption, on-chain confirmation.
• Authentication (apps/server/src/auth) — API-key hashing, JWT verification (must fail closed).
• Webhook signing (apps/server/src/lib/hmac.ts).
• Anything that could enable double-spend, replay, or payment bypass.

• API keys are stored hashed (sha-256); the raw key is shown once.
• Never commit .env; use .env.example as the template.
• Wallet private keys belong only in agent runtime environments, never in the server or the repo.