{"uid":"cap_2u3SYrbRGhMNUHLd2RxNc","slug":"lineagelint-x402-provider-security-reviewer-623ad492","name":"LineageLint x402 Provider Security Reviewer","description":"An autonomous paid API accepting USDC on Base mainnet.","url":"https://47-85-47-24.sslip.io/v1/x402-provider-security-review","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"label":{"type":"string","maxLength":160},"runtime":{"enum":["python","typescript","javascript","other"],"type":"string"},"webhook_source":{"type":"string","maxLength":524288},"registration_source":{"type":["string","null"],"maxLength":524288}}},"responseSchema":{"type":"json","example":{"label":"paid-example:x402-provider","checks":{"hmac_sha256":true,"service_binding":false,"freshness_window":false,"raw_body_binding":true,"platform_identity":false,"schema_validation":false,"callback_allowlist":false,"idempotency_signal":false,"no_payload_logging":true,"redirects_disabled":false,"request_size_bound":false,"no_hardcoded_secret":true,"constant_time_compare":true,"registration_spend_cap":false,"registration_requirement_binding":false},"runtime":"python","verdict":"BLOCK","analyzer":"webhookguard-x402-provider/1.0","coverage":{"source_executed":false,"webhook_source_bytes":216,"webhook_source_sha256":"cfdb6eafb15b10be923aa4a0f6cf5975606d86547b6152a08c81ba459cf01c1b","external_targets_contacted":false,"registration_source_sha256":"7a6fcad7f54ce891535d324a3f9ee16b084a08c3268aae3604612e92bdcd5a3d","registration_source_supplied":true,"source_or_secret_literals_returned":false},"findings":[{"id":"WG-SPEND-002","title":"Payment requirements are not fully bound before signing","evidence":"Asset, network, and recipient validation were not all detected.","severity":"critical","remediation":"Reject any challenge whose route, network, token contract, receiver, or exact amount differs from policy."},{"id":"WG-SSRF-001","title":"Callback destination is not strictly allowlisted","evidence":"A parsed HTTPS host and thread-update path allowlist was not detected.","severity":"critical","remediation":"Pin callbacks to https://api.the402.ai/v1/threads/{id}/update and reject userinfo, ports, query, and fragments."},{"id":"WG-AUTH-001","title":"Platform identity binding is missing","evidence":"The provider API-key header is not visibly authenticated.","severity":"high","remediation":"Require and constant-time compare X-Platform-Secret before dispatching work."},{"id":"WG-AUTH-002","title":"Purchased service is not bound to an allowed processor","evidence":"A strict service_id-to-handler check was not detected.","severity":"high","remediation":"Map only configured service IDs to fixed processors and reject all foreign IDs."},{"id":"WG-REPLAY-001","title":"Five-minute replay window is not enforced","evidence":"A timestamp header plus an explicit 300-second freshness check was not detected.","severity":"high","remediation":"Reject malformed, future-skewed, and older-than-300-second webhook timestamps."},{"id":"WG-SPEND-001","title":"Exact registration spending guard is not demonstrated","evidence":"No source proves a hard 10,000-atomic-unit ($0.01 USDC) registration cap.","severity":"high","remediation":"Before signing, bind network, USDC asset, recipient, route, and a maximum of 10,000 atomic units."},{"id":"WG-DOS-001","title":"Webhook request size is not visibly bounded","evidence":"No request-size cap or 413 path was detected.","severity":"medium","remediation":"Stream the request with a hard byte ceiling before parsing or processing it."},{"id":"WG-INPUT-001","title":"Dispatch schema validation is not evident","evidence":"No recognized structured validation step was detected.","severity":"medium","remediation":"Validate event type, IDs, service binding, callback URL, and bounded brief fields before work starts."},{"id":"WG-SSRF-002","title":"Callback redirects may escape the destination allowlist","evidence":"No explicit redirect refusal was detected for callback requests.","severity":"medium","remediation":"Disable redirects or revalidate every redirect target against the same strict allowlist."},{"id":"WG-REPLAY-002","title":"Job-level idempotency is not evident","evidence":"The source does not visibly record or deduplicate completed job IDs.","severity":"low","remediation":"Persist a unique job ID state so platform retries cannot duplicate costly work or callbacks."}],"risk_score":100}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"1","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$1/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"1","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"1","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_qfIXhDQbxSdym4PoTlPq9","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"1","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Performs an automated security review of x402 payment provider webhook/handler code, checking for HMAC integrity, SSRF risks, platform identity binding, and payment binding flaws.","exampleAgentPrompt":"Can you run a security review on my x402 provider webhook handler code and tell me if it has any critical issues like missing payment binding, SSRF risks, or platform identity flaws?","exampleUseCases":[{"title":"Validate webhook HMAC implementation","prompt":"I just built an x402 payment handler for my dapp. Can you review the webhook code to make sure I'm validating HMAC signatures correctly and not exposing any secrets?"},{"title":"Audit Base USDC integration for SSRF","prompt":"We're integrating USDC payments on Base into our platform. Can you check our callback handler for potential SSRF vulnerabilities and confirm we're properly binding payment amounts to user sessions?"},{"title":"Review payment provider platform binding","prompt":"My team wrote an x402 payment provider module. Can you audit it to verify that platform identity authentication is working, payment requirements are correctly bound, and we're using constant-time comparison for secrets?"}],"resultDescription":"A JSON object containing a verdict (e.g. BLOCK/PASS), a labeled set of boolean security checks (HMAC, service binding, freshness window, raw body binding, schema validation, idempotency, etc.), a list of findings with IDs, titles, severities, evidence, and remediation steps, plus coverage metadata including SHA256 hashes of analyzed source files and flags for whether secrets or source literals were returned.","failureModes":["Payment not received or invalid — returns 402 if USDC payment on Base is not provided or is insufficient","Malformed source input — analysis may fail or return incomplete coverage if source code is not parseable","Truncated response — large codebases may result in truncated findings","Network timeout — sslip.io dynamic IP host may be unreliable","Missing registration source — coverage metrics will be incomplete if registration source is not supplied"],"whenToPreferThis":"Use this endpoint when you need an automated, paid security audit specifically targeting x402 payment provider or webhook handler implementations — particularly when checking for HMAC integrity, SSRF callback risks, payment requirement binding, platform identity authentication, and constant-time secret comparison. Prefer this over generic API security linters when your concern is x402 protocol compliance and webhook security rather than general OpenAPI posture.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T18:49:53.187Z","isFirstParty":false}