Use GitHub's private vulnerability reporting on this repository to disclose suspected security issues. This routes the report directly to the maintainer through a private GitHub Security Advisory and keeps the issue out of the public tracker until a fix is ready.

If GitHub's private reporting is unavailable, email kaleche@gmail.com with the subject line x402-batch-settlement security. PGP is not required.

This is research-and-reference code. There is no production deployment, no service SLA, and no bug bounty. The maintainer will respond on a best-effort basis. Please include:

• A clear description of the issue and what it lets an attacker do.
• A minimal reproduction (commit hash, command line, expected vs. observed behaviour).
• Optionally, a proposed fix or mitigation.

• The crates/x402 protocol crate (codec, EIP-712 derivation, signature recovery, wire types).
• The poc-x402-llm router and its handling of payment, claim, and settle flows.
• Test fixtures and CI configuration that, if tampered with, could hide a real defect.

• Vulnerabilities or limitations in the hosted x402 facilitator at https://www.x402.org/facilitator — those are out-of-process and belong upstream. Operational ordering races observed against that facilitator are tracked openly in x402-foundation/x402#2471.
• Vulnerabilities or limitations in the x402 protocol specification itself — those belong on x402-foundation/x402.
• Test-USDC on Base Sepolia, which has no economic value.