Effective date: 2026-07-28
Contact: hello@sqlguard.io
Canonical: https://sqlguard.io/security · https://sqlguard.io/.well-known/security.txt

Email hello@sqlguard.io with subject SECURITY: and include:

• description and impact
• reproduction steps / PoC (non-destructive preferred)
• affected URL, host, or commit
• your contact for coordination

Please do not open a public GitHub issue for undisclosed vulnerabilities. Do not access other customers’ data, destroy data, or perform high-volume DoS.

We aim to acknowledge within 72 hours and provide a remediation timeline after triage.

In scope: SQLGuard HTTP/MCP APIs on production hosts (sqlguard.io, sqlguard-io.fly.dev), certificate issuance/verification, credit/payment enforcement, Session/BIND/GATE logic, authz fail-closed paths.

Out of scope: third-party facilitators, blockchain consensus bugs, social engineering of unrelated accounts, physical attacks, spam, and DoS via enormous legitimate paid traffic without prior coordination.

Good-faith research that avoids privacy violations, data destruction, and service disruption, and that promptly reports findings, is appreciated and will not be treated as an AUP/Terms violation solely for that research.

• TLS terminated at the edge; Helmet CSP (script-src 'self', frame-ancestors 'none') + X-Frame-Options: DENY
• connect-src allowlist: self + Base RPC + PayAI/CDP facilitators (buy wallet path)
• Rate limits on public HTTP (RATE_LIMIT_PER_MIN)
• Ed25519 attestations; demo sandbox rejected in production verify unless explicitly allowed
• Public executor fail-closed by default; bootstrap credits require token + ALLOW_BOOTSTRAP in production
• Secrets never committed (keys/, .env*, .tmp*); scrub dumps with node scripts/secure-scrub.mjs
• CI: .github/workflows/security.yml (gitleaks + npm audit); GitHub push protection enabled
• /verify UI uses external /verify.js (no inline script under CSP)
• Agent id mismatch rejected before x402 (not masked as unpaid 402)
• Exact fulfillment: wallet agent_id must match payment payer when both are 0x addresses
• Continuous probe: npm run audit:security (scripts/security-audit-1pct.mjs)

hello@sqlguard.io
https://sqlguard.io/.well-known/security.txt