A payments protocol for the internet. Built on HTTP.
This report summarizes scanner evidence for x402-foundation/x402, a TypeScript project with 6,703 GitHub stars. SynthScan examined 780,153 lines of code across 3056 source files, recording 5740 pattern matches distributed across 23 syntactic categories. The legacy adjusted pattern signal is 10.3 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 3410 finding(s).
Are imports declared and package/API names verified? 1292 finding(s).
Are wrappers, guards, and repeated structures necessary? 3787 finding(s).
Which changes need focused human review? 5740 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 5740 distinct pattern matches across 23 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/legacy/tests/test_exact.py | 53 | def test_prepare_payment_header(account, payment_requirements): | CODE |
| LOW | python/legacy/tests/test_exact.py | 107 | def test_sign_payment_header_no_account(payment_requirements): | CODE |
| LOW | python/legacy/tests/test_paywall.py | 13 | def test_browser_request_with_html_accept_and_mozilla(self): | CODE |
| LOW | python/legacy/tests/test_paywall.py | 20 | def test_browser_request_case_insensitive(self): | CODE |
| LOW | python/legacy/tests/test_paywall.py | 38 | def test_html_accept_but_no_mozilla(self): | CODE |
| LOW | python/legacy/tests/test_paywall.py | 45 | def test_mozilla_user_agent_but_no_html(self): | CODE |
| LOW | python/legacy/tests/test_paywall.py | 56 | def test_create_config_with_payment_requirements(self): | CODE |
| LOW | python/legacy/tests/test_paywall.py | 80 | def test_create_config_with_mainnet(self): | CODE |
| LOW | python/legacy/tests/test_paywall.py | 98 | def test_create_config_with_paywall_config(self): | CODE |
| LOW | python/legacy/tests/test_paywall.py | 121 | def test_create_config_empty_requirements(self): | CODE |
| LOW | python/legacy/tests/test_paywall.py | 133 | def test_inject_payment_data_basic(self): | CODE |
| LOW | python/legacy/tests/test_paywall.py | 164 | def test_inject_payment_data_mainnet_no_console_log(self): | STRING |
| LOW | python/legacy/tests/test_paywall.py | 194 | def test_inject_preserves_html_structure(self): | STRING |
| LOW | python/legacy/tests/test_paywall.py | 260 | def test_script_close_tag_in_resource_url_is_escaped(self): | CODE |
| LOW | python/legacy/tests/test_paywall.py | 274 | def test_lt_gt_amp_escaped_inside_script_block(self): | CODE |
| LOW | python/legacy/tests/test_paywall.py | 282 | def test_escaped_json_still_round_trips(self): | CODE |
| LOW | python/legacy/tests/test_paywall.py | 295 | def test_get_paywall_html_integration(self): | CODE |
| LOW | python/legacy/tests/test_common.py | 49 | def test_process_price_to_atomic_amount_money(): | CODE |
| LOW | python/legacy/tests/test_common.py | 69 | def test_process_price_to_atomic_amount_token(): | CODE |
| LOW | python/legacy/tests/test_common.py | 90 | def test_process_price_to_atomic_amount_invalid(): | CODE |
| LOW | python/legacy/tests/test_common.py | 110 | def test_find_matching_payment_requirements(): | CODE |
| LOW | python/legacy/tests/test_encoding.py | 53 | def test_encode_decode_roundtrip(): | CODE |
| LOW | python/legacy/tests/test_types.py | 13 | def test_payment_requirements_serde(): | CODE |
| LOW | python/legacy/tests/test_types.py | 91 | def test_exact_payment_payload_serde(): | CODE |
| LOW | python/legacy/tests/test_types.py | 106 | def test_verify_response_serde(): | CODE |
| LOW | python/legacy/tests/test_types.py | 113 | def test_settle_response_serde(): | CODE |
| LOW | python/legacy/tests/test_types.py | 132 | def test_payment_payload_serde(): | CODE |
| LOW | python/legacy/tests/clients/test_requests.py | 79 | def test_adapter_send_success(adapter): | CODE |
| LOW | python/legacy/tests/clients/test_requests.py | 132 | def test_adapter_payment_flow(adapter, payment_requirements): | CODE |
| LOW | python/legacy/tests/clients/test_requests.py | 209 | def test_adapter_payment_error(adapter, payment_requirements): | CODE |
| LOW | python/legacy/tests/clients/test_requests.py | 237 | def test_adapter_general_error(adapter): | CODE |
| LOW | python/legacy/tests/clients/test_httpx.py | 67 | async def test_on_response_missing_request(hooks): | CODE |
| LOW | python/legacy/tests/clients/test_httpx.py | 78 | async def test_on_response_payment_flow(hooks, payment_requirements): | CODE |
| LOW | python/legacy/tests/clients/test_httpx.py | 141 | async def test_on_response_payment_error(hooks, payment_requirements): | CODE |
| LOW | python/legacy/tests/clients/test_httpx.py | 163 | async def test_on_response_general_error(hooks): | CODE |
| LOW | python/legacy/tests/clients/test_base.py | 45 | def test_decode_x_payment_response(): | CODE |
| LOW | python/legacy/tests/clients/test_base.py | 72 | def test_client_initialization(account): | CODE |
| LOW | python/legacy/tests/clients/test_base.py | 108 | def test_select_payment_requirements(client, payment_requirements): | CODE |
| LOW | python/legacy/tests/clients/test_base.py | 132 | def test_select_payment_requirements_amount_exceeded(client, payment_requirements): | CODE |
| LOW | python/legacy/tests/clients/test_base.py | 140 | def test_create_payment_header(client, payment_requirements): | CODE |
| LOW | python/legacy/tests/clients/test_base.py | 157 | def test_payment_requirements_sorting(client): | CODE |
| LOW | python/legacy/tests/flask_tests/test_middleware.py | 5 | def create_app_with_middleware(configs): | CODE |
| LOW | python/legacy/tests/flask_tests/test_middleware.py | 22 | def test_payment_required_for_protected_route(): | CODE |
| LOW | python/legacy/tests/flask_tests/test_middleware.py | 58 | def test_invalid_payment_header(): | CODE |
| LOW | python/legacy/tests/flask_tests/test_middleware.py | 76 | def test_path_pattern_matching(): | CODE |
| LOW | python/legacy/tests/flask_tests/test_middleware.py | 106 | def test_multiple_middleware_configs(): | CODE |
| LOW | python/legacy/tests/flask_tests/test_middleware.py | 136 | def test_payment_details_in_g(): | CODE |
| LOW | python/legacy/tests/flask_tests/test_middleware.py | 155 | def test_browser_request_returns_html(): | CODE |
| LOW | python/legacy/tests/flask_tests/test_middleware.py | 185 | def test_api_client_request_returns_json(): | CODE |
| LOW | python/legacy/tests/flask_tests/test_middleware.py | 213 | def test_paywall_config_injection(): | CODE |
| LOW | python/legacy/tests/flask_tests/test_middleware.py | 290 | def test_mainnet_vs_testnet_config(): | STRING |
| LOW | python/legacy/tests/flask_tests/test_middleware.py | 335 | def test_payment_amount_conversion(): | CODE |
| LOW | python/legacy/tests/fastapi_tests/test_middleware.py | 11 | def test_middleware_invalid_payment(): | CODE |
| LOW | python/legacy/tests/fastapi_tests/test_middleware.py | 31 | def test_app_middleware_path_matching(): | CODE |
| LOW | python/legacy/tests/fastapi_tests/test_middleware.py | 58 | def test_middleware_path_list_matching(): | CODE |
| LOW | python/legacy/tests/fastapi_tests/test_middleware.py | 320 | def test_browser_request_returns_html(): | CODE |
| LOW | python/legacy/tests/fastapi_tests/test_middleware.py | 350 | def test_api_client_request_returns_json(): | CODE |
| LOW | python/legacy/tests/fastapi_tests/test_middleware.py | 378 | def test_paywall_config_injection(): | CODE |
| LOW | python/legacy/tests/fastapi_tests/test_middleware.py | 458 | def test_mainnet_vs_testnet_config(): | STRING |
| LOW | python/legacy/tests/fastapi_tests/test_middleware.py | 505 | def test_payment_amount_conversion(): | CODE |
| 2680 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | go/mechanisms/evm/upto/facilitator/permit2_test.go | 19 | // ─── Mock facilitator signer ──────────────────────────────────────────────── | COMMENT |
| MEDIUM | go/mechanisms/evm/upto/facilitator/permit2_test.go | 102 | // ─── Test addresses (valid 40-hex-char Ethereum addresses) ────────────────── | COMMENT |
| MEDIUM | go/mechanisms/evm/upto/facilitator/permit2_test.go | 177 | // ─── VerifyUptoPermit2 — asset contract validation ─────────────────────────── | COMMENT |
| MEDIUM | go/mechanisms/evm/upto/facilitator/permit2_test.go | 211 | // ─── VerifyUptoPermit2 — input validation tests ────────────────────────────── | COMMENT |
| MEDIUM | go/mechanisms/evm/upto/facilitator/permit2_test.go | 454 | // ─── SettleUptoPermit2 tests ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | go/mechanisms/evm/upto/facilitator/permit2_test.go | 578 | // ─── SettleUptoPermit2 — PendingSettlementStore fast path ─────────────────── | COMMENT |
| MEDIUM | go/mechanisms/evm/upto/facilitator/permit2_test.go | 845 | // ─── BuildUptoPermit2SettleArgs tests ──────────────────────────────────────── | COMMENT |
| MEDIUM | go/mechanisms/evm/upto/facilitator/permit2_test.go | 918 | // ─── validateEip2612PermitForPayment tests ─────────────────────────────────── | COMMENT |
| MEDIUM | go/mechanisms/evm/upto/facilitator/permit2_test.go | 973 | // ─── splitEip2612Signature tests ───────────────────────────────────────────── | COMMENT |
| MEDIUM | go/mechanisms/evm/upto/facilitator/permit2_test.go | 1012 | // ─── parseUptoPermit2Error tests ───────────────────────────────────────────── | COMMENT |
| MEDIUM | go/mechanisms/evm/upto/facilitator/permit2_test.go | 1043 | // ─── UptoEvmScheme wrapper tests ───────────────────────────────────────────── | COMMENT |
| MEDIUM | go/mechanisms/evm/upto/facilitator/permit2_test.go | 1176 | // ─── Helpers ────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | go/mechanisms/evm/batch-settlement/errors.go | 13 | // ── Facilitator-emitted reason shared with the client ───────────────── | COMMENT |
| MEDIUM | go/mechanisms/evm/batch-settlement/errors.go | 23 | // ── Resource-server-emitted reasons ─────────────────────────────────── | COMMENT |
| MEDIUM | python/x402/interfaces.py | 44 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/interfaces.py | 46 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/interfaces.py | 84 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/interfaces.py | 86 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/interfaces.py | 170 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/interfaces.py | 172 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | python/x402/interfaces.py | 261 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | python/x402/interfaces.py | 263 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/interfaces.py | 410 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/interfaces.py | 412 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | python/x402/server.py | 61 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | python/x402/server.py | 63 | # ============================================================================ | COMMENT |
| MEDIUM⚡ | python/x402/server.py | 243 | # ======================================================================== | COMMENT |
| MEDIUM⚡ | python/x402/server.py | 245 | # ======================================================================== | COMMENT |
| MEDIUM⚡ | python/x402/server.py | 495 | # ======================================================================== | COMMENT |
| MEDIUM⚡ | python/x402/server.py | 497 | # ======================================================================== | COMMENT |
| MEDIUM⚡ | python/x402/server.py | 563 | # ======================================================================== | COMMENT |
| MEDIUM⚡ | python/x402/server.py | 565 | # ======================================================================== | COMMENT |
| MEDIUM | python/x402/server.py | 117 | # ======================================================================== | COMMENT |
| MEDIUM | python/x402/server.py | 119 | # ======================================================================== | COMMENT |
| MEDIUM | python/x402/server.py | 175 | # ======================================================================== | COMMENT |
| MEDIUM | python/x402/server.py | 177 | # ======================================================================== | COMMENT |
| MEDIUM | python/x402/server.py | 382 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/server.py | 384 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/server.py | 456 | # ======================================================================== | COMMENT |
| MEDIUM | python/x402/server.py | 458 | # ======================================================================== | COMMENT |
| MEDIUM⚡ | python/x402/server_base.py | 593 | # ======================================================================== | COMMENT |
| MEDIUM⚡ | python/x402/server_base.py | 595 | # ======================================================================== | COMMENT |
| MEDIUM⚡ | python/x402/server_base.py | 670 | # ======================================================================== | COMMENT |
| MEDIUM⚡ | python/x402/server_base.py | 672 | # ======================================================================== | COMMENT |
| MEDIUM⚡ | python/x402/server_base.py | 1088 | # ======================================================================== | COMMENT |
| MEDIUM⚡ | python/x402/server_base.py | 1090 | # ======================================================================== | COMMENT |
| MEDIUM | python/x402/server_base.py | 276 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/server_base.py | 278 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/server_base.py | 329 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/server_base.py | 331 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/server_base.py | 389 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/server_base.py | 391 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/server_base.py | 438 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/server_base.py | 440 | # ============================================================================ | COMMENT |
| MEDIUM | python/x402/server_base.py | 489 | # ======================================================================== | COMMENT |
| MEDIUM | python/x402/server_base.py | 491 | # ======================================================================== | COMMENT |
| MEDIUM | python/x402/server_base.py | 1193 | # ======================================================================== | COMMENT |
| MEDIUM | python/x402/server_base.py | 1195 | # ======================================================================== | COMMENT |
| MEDIUM | python/x402/server_base.py | 1349 | # ======================================================================== | COMMENT |
| MEDIUM | python/x402/server_base.py | 1351 | # ======================================================================== | COMMENT |
| 499 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/legacy/src/x402/types.py | 1 | CODE | |
| LOW | python/legacy/src/x402/clients/__init__.py | 1 | CODE | |
| LOW | python/legacy/src/x402/clients/__init__.py | 1 | CODE | |
| LOW | python/legacy/src/x402/clients/__init__.py | 2 | CODE | |
| LOW | python/legacy/src/x402/clients/__init__.py | 2 | CODE | |
| LOW | python/legacy/src/x402/clients/__init__.py | 6 | CODE | |
| LOW | python/legacy/src/x402/clients/__init__.py | 6 | CODE | |
| LOW | python/legacy/src/x402/clients/__init__.py | 6 | CODE | |
| LOW | python/x402/interfaces.py | 9 | CODE | |
| LOW | python/x402/server.py | 8 | CODE | |
| LOW | python/x402/server.py | 15 | CODE | |
| LOW | python/x402/server_base.py | 6 | CODE | |
| LOW | python/x402/facilitator_base.py | 6 | CODE | |
| LOW | python/x402/pending_settlement_store.py | 31 | CODE | |
| LOW | python/x402/client.py | 7 | CODE | |
| LOW | python/x402/client.py | 15 | CODE | |
| LOW | python/x402/client.py | 15 | CODE | |
| LOW | python/x402/client.py | 15 | CODE | |
| LOW | python/x402/client.py | 15 | CODE | |
| LOW | python/x402/client.py | 15 | CODE | |
| LOW | python/x402/client.py | 15 | CODE | |
| LOW | python/x402/client.py | 15 | CODE | |
| LOW | python/x402/client.py | 15 | CODE | |
| LOW | python/x402/hook_policy.py | 3 | CODE | |
| LOW | python/x402/__init__.py | 55 | CODE | |
| LOW | python/x402/__init__.py | 55 | CODE | |
| LOW | python/x402/__init__.py | 55 | CODE | |
| LOW | python/x402/__init__.py | 55 | CODE | |
| LOW | python/x402/__init__.py | 55 | CODE | |
| LOW | python/x402/__init__.py | 55 | CODE | |
| LOW | python/x402/__init__.py | 55 | CODE | |
| LOW | python/x402/__init__.py | 55 | CODE | |
| LOW | python/x402/__init__.py | 55 | CODE | |
| LOW | python/x402/__init__.py | 55 | CODE | |
| LOW | python/x402/__init__.py | 55 | CODE | |
| LOW | python/x402/__init__.py | 68 | CODE | |
| LOW | python/x402/__init__.py | 68 | CODE | |
| LOW | python/x402/__init__.py | 71 | CODE | |
| LOW | python/x402/__init__.py | 71 | CODE | |
| LOW | python/x402/__init__.py | 71 | CODE | |
| LOW | python/x402/__init__.py | 71 | CODE | |
| LOW | python/x402/__init__.py | 71 | CODE | |
| LOW | python/x402/__init__.py | 71 | CODE | |
| LOW | python/x402/__init__.py | 71 | CODE | |
| LOW | python/x402/__init__.py | 71 | CODE | |
| LOW | python/x402/__init__.py | 71 | CODE | |
| LOW | python/x402/__init__.py | 71 | CODE | |
| LOW | python/x402/__init__.py | 83 | CODE | |
| LOW | python/x402/__init__.py | 83 | CODE | |
| LOW | python/x402/__init__.py | 83 | CODE | |
| LOW | python/x402/__init__.py | 83 | CODE | |
| LOW | python/x402/__init__.py | 83 | CODE | |
| LOW | python/x402/__init__.py | 83 | CODE | |
| LOW | python/x402/__init__.py | 93 | CODE | |
| LOW | python/x402/__init__.py | 93 | CODE | |
| LOW | python/x402/__init__.py | 93 | CODE | |
| LOW | python/x402/__init__.py | 93 | CODE | |
| LOW | python/x402/__init__.py | 101 | CODE | |
| LOW | python/x402/__init__.py | 101 | CODE | |
| LOW | python/x402/__init__.py | 101 | CODE | |
| 1209 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | python/x402/server.py | 0 | execute hook synchronously. raises if async hook detected. | STRING |
| HIGH | python/x402/client.py | 0 | execute hook synchronously. raises if async hook detected. | STRING |
| HIGH | python/x402/facilitator.py | 0 | execute hook synchronously. raises if async hook detected. | STRING |
| HIGH | python/x402/facilitator_base.py | 0 | get supported payment kinds and extensions. returns: supportedresponse with kinds, extensions, and signers. | STRING |
| HIGH | examples/python/facilitator/advanced/bazaar.py | 0 | get supported payment kinds and extensions. returns: supportedresponse with kinds, extensions, and signers. | STRING |
| HIGH | examples/python/facilitator/advanced/all_networks.py | 0 | get supported payment kinds and extensions. returns: supportedresponse with kinds, extensions, and signers. | STRING |
| HIGH | examples/python/facilitator/basic/main.py | 0 | get supported payment kinds and extensions. returns: supportedresponse with kinds, extensions, and signers. | STRING |
| HIGH | e2e/facilitators/python/main.py | 0 | get supported payment kinds and extensions. returns: supportedresponse with kinds, extensions, and signers. | STRING |
| HIGH | python/x402/mechanisms/svm/default_assets.py | 0 | look up a default asset by network and optional ticker. args: network: caip-2 network. symbol: ticker; omit for the netw | STRING |
| HIGH | python/x402/mechanisms/evm/default_assets.py | 0 | look up a default asset by network and optional ticker. args: network: caip-2 network. symbol: ticker; omit for the netw | STRING |
| HIGH | python/x402/mechanisms/tvm/default_assets.py | 0 | look up a default asset by network and optional ticker. args: network: caip-2 network. symbol: ticker; omit for the netw | STRING |
| HIGH | python/x402/mechanisms/svm/signers.py | 0 | get or create rpc client for network. args: network: network identifier. returns: solana rpc client. | STRING |
| HIGH | python/x402/mechanisms/svm/exact/client.py | 0 | get or create rpc client for network. args: network: network identifier. returns: solana rpc client. | STRING |
| HIGH | python/x402/mechanisms/svm/exact/v1/client.py | 0 | get or create rpc client for network. args: network: network identifier. returns: solana rpc client. | STRING |
| HIGH | python/x402/mechanisms/svm/exact/v1/facilitator.py | 0 | get facilitator wallet addresses. args: network: network identifier. returns: list of facilitator addresses. | STRING |
| HIGH | python/x402/mechanisms/evm/exact/facilitator.py | 0 | get facilitator wallet addresses. args: network: network identifier. returns: list of facilitator addresses. | STRING |
| HIGH | python/x402/mechanisms/evm/exact/v1/facilitator.py | 0 | get facilitator wallet addresses. args: network: network identifier. returns: list of facilitator addresses. | STRING |
| HIGH | …hon/x402/tests/unit/mechanisms/svm/test_facilitator.py | 0 | signer whose broadcast never confirms in time (settlement_pending). | STRING |
| HIGH | python/x402/tests/unit/mechanisms/evm/test_permit2.py | 0 | signer whose broadcast never confirms in time (settlement_pending). | STRING |
| HIGH | …hon/x402/tests/unit/mechanisms/evm/test_facilitator.py | 0 | signer whose broadcast never confirms in time (settlement_pending). | STRING |
| HIGH | …402/tests/unit/mechanisms/evm/test_upto_facilitator.py | 0 | signer whose broadcast never confirms in time (settlement_pending). | STRING |
| HIGH | …hon/x402/tests/unit/mechanisms/svm/test_facilitator.py | 0 | a caller-supplied pendingsettlementstore must be the instance actually used, not merely accepted and ignored in favor of | STRING |
| HIGH | …hon/x402/tests/unit/mechanisms/evm/test_facilitator.py | 0 | a caller-supplied pendingsettlementstore must be the instance actually used, not merely accepted and ignored in favor of | STRING |
| HIGH | …402/tests/unit/mechanisms/evm/test_upto_facilitator.py | 0 | a caller-supplied pendingsettlementstore must be the instance actually used, not merely accepted and ignored in favor of | STRING |
| HIGH | …anisms/evm/batch_settlement/facilitator/test_scheme.py | 0 | a caller-supplied pendingsettlementstore must be the instance actually used, not merely accepted and ignored in favor of | STRING |
| HIGH | python/x402/tests/unit/mechanisms/svm/test_types.py | 0 | should preserve data through serialization round-trip. | STRING |
| HIGH | python/x402/tests/unit/mechanisms/evm/test_types.py | 0 | should preserve data through serialization round-trip. | STRING |
| HIGH | python/x402/tests/unit/mechanisms/tvm/test_types.py | 0 | should preserve data through serialization round-trip. | STRING |
| HIGH | python/x402/tests/unit/http/test_x402_http_client.py | 0 | test that 402 response triggers payment creation and retry. | STRING |
| HIGH | python/x402/tests/unit/http/clients/test_requests.py | 0 | test that 402 response triggers payment creation and retry. | STRING |
| HIGH | python/x402/tests/unit/http/clients/test_httpx.py | 0 | test that 402 response triggers payment creation and retry. | STRING |
| HIGH | examples/python/clients/advanced/all_networks.py | 0 | all networks server example. demonstrates how to create a server that supports all available networks with optional chai | STRING |
| HIGH | examples/python/facilitator/advanced/all_networks.py | 0 | all networks server example. demonstrates how to create a server that supports all available networks with optional chai | STRING |
| HIGH | examples/python/servers/advanced/all_networks.py | 0 | all networks server example. demonstrates how to create a server that supports all available networks with optional chai | STRING |
| HIGH | examples/python/clients/advanced/all_networks.py | 0 | validate required environment variables. returns: tuple of (evm_private_key, svm_private_key, base_url, endpoint_path). | STRING |
| HIGH | examples/python/clients/requests/main.py | 0 | validate required environment variables. returns: tuple of (evm_private_key, svm_private_key, base_url, endpoint_path). | STRING |
| HIGH | examples/python/clients/httpx/main.py | 0 | validate required environment variables. returns: tuple of (evm_private_key, svm_private_key, base_url, endpoint_path). | STRING |
| HIGH | examples/python/clients/custom/main.py | 0 | validate required environment variables. returns: tuple of (evm_private_key, svm_private_key, base_url, endpoint_path). | STRING |
| HIGH | examples/python/clients/mcp/advanced.py | 0 | connect - already connected via session context manager. | STRING |
| HIGH | examples/python/clients/mcp/simple.py | 0 | connect - already connected via session context manager. | STRING |
| HIGH | examples/python/clients/mcp-chatbot/main.py | 0 | connect - already connected via session context manager. | STRING |
| HIGH | examples/python/facilitator/advanced/bazaar.py | 0 | settle a payment on-chain. args: request: payment payload and requirements to settle. returns: settleresponse with succe | STRING |
| HIGH | examples/python/facilitator/advanced/all_networks.py | 0 | settle a payment on-chain. args: request: payment payload and requirements to settle. returns: settleresponse with succe | STRING |
| HIGH | examples/python/facilitator/basic/main.py | 0 | settle a payment on-chain. args: request: payment payload and requirements to settle. returns: settleresponse with succe | STRING |
| HIGH | examples/python/servers/mcp/advanced.py | 0 | get current weather for a city. requires payment of $0.001. | STRING |
| HIGH | examples/python/servers/mcp/existing_server.py | 0 | get current weather for a city. requires payment of $0.001. | STRING |
| HIGH | examples/python/servers/mcp/simple.py | 0 | get current weather for a city. requires payment of $0.001. | STRING |
| HIGH | scripts/prepare-typescript-release.py | 0 | query($owner: string!, $name: string!, $number: int!, $after: string) { repository(owner: $owner, name: $name) { pullreq | STRING |
| HIGH | scripts/prepare-go-release.py | 0 | query($owner: string!, $name: string!, $number: int!, $after: string) { repository(owner: $owner, name: $name) { pullreq | STRING |
| HIGH | scripts/prepare-python-release.py | 0 | query($owner: string!, $name: string!, $number: int!, $after: string) { repository(owner: $owner, name: $name) { pullreq | STRING |
| HIGH | scripts/prepare-typescript-release.py | 0 | raised when the release-prep inputs or files are invalid. | STRING |
| HIGH | scripts/prepare-go-release.py | 0 | raised when the release-prep inputs or files are invalid. | STRING |
| HIGH | scripts/prepare-python-release.py | 0 | raised when the release-prep inputs or files are invalid. | STRING |
| HIGH | scripts/tag-python-release.py | 0 | raised when the release-tag inputs or git state are invalid. | STRING |
| HIGH | scripts/tag-go-release.py | 0 | raised when the release-tag inputs or git state are invalid. | STRING |
| HIGH | scripts/tag-typescript-release.py | 0 | raised when the release-tag inputs or git state are invalid. | STRING |
| HIGH | scripts/tag-python-release.py | 0 | reduce a git remote url to its ``owner/repo`` form. | STRING |
| HIGH | scripts/tag-go-release.py | 0 | reduce a git remote url to its ``owner/repo`` form. | STRING |
| HIGH | scripts/tag-typescript-release.py | 0 | reduce a git remote url to its ``owner/repo`` form. | STRING |
| HIGH | scripts/tag-python-release.py | 0 | refuse to tag unless head is exactly the release remote's main head. tags point at the currently checked-out commit, so | STRING |
| 5 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | python/legacy/src/x402/chains.py | 16 | except ValueError: | CODE |
| HIGH | python/x402/mechanisms/svm/utils.py | 45 | except ParseHashError: | CODE |
| HIGH | python/x402/mechanisms/svm/exact/facilitator.py | 550 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/evm/multicall.py | 134 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/evm/multicall.py | 140 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/evm/settle_receipt.py | 97 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/evm/upto/client.py | 44 | except ImportError: | CODE |
| HIGH | python/x402/mechanisms/evm/upto/client.py | 132 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/evm/upto/client.py | 186 | except Exception: | CODE |
| HIGH | …/x402/mechanisms/evm/batch_settlement/storage_utils.py | 60 | except FileNotFoundError: | CODE |
| HIGH | …/x402/mechanisms/evm/batch_settlement/storage_utils.py | 51 | except OSError: | CODE |
| HIGH | …mechanisms/evm/batch_settlement/server/file_storage.py | 120 | except FileNotFoundError: | CODE |
| HIGH | …mechanisms/evm/batch_settlement/server/file_storage.py | 115 | except OSError: | CODE |
| HIGH | …mechanisms/evm/batch_settlement/server/file_storage.py | 80 | except FileNotFoundError: | CODE |
| HIGH | …hanisms/evm/batch_settlement/server/channel_manager.py | 135 | except asyncio.CancelledError: | CODE |
| HIGH | …/x402/mechanisms/evm/batch_settlement/client/scheme.py | 61 | except ImportError: | CODE |
| HIGH | …/x402/mechanisms/evm/batch_settlement/client/scheme.py | 318 | except Exception: | CODE |
| HIGH | …/x402/mechanisms/evm/batch_settlement/client/scheme.py | 374 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/evm/exact/client.py | 36 | except ImportError: | CODE |
| HIGH | python/x402/mechanisms/evm/exact/client.py | 172 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/evm/exact/client.py | 228 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/evm/exact/eip3009_utils.py | 290 | except (TypeError, ValueError): | CODE |
| HIGH | python/x402/mechanisms/evm/exact/v1/client.py | 117 | except ValueError: | CODE |
| HIGH | python/x402/mechanisms/tvm/provider.py | 713 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/tvm/provider.py | 546 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/tvm/provider.py | 588 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/tvm/provider.py | 511 | except ValueError: | CODE |
| HIGH | python/x402/mechanisms/tvm/signers.py | 83 | except ValueError: | CODE |
| HIGH | python/x402/mechanisms/tvm/signers.py | 299 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/tvm/signers.py | 305 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/tvm/signers.py | 431 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/tvm/trace_utils.py | 46 | except ValueError: | CODE |
| HIGH | python/x402/mechanisms/tvm/streaming.py | 107 | except Exception: | CODE |
| HIGH | python/x402/mechanisms/tvm/streaming.py | 112 | except Exception: | CODE |
| HIGH | python/x402/tests/integrations/test_mcp_evm.py | 262 | except Exception: | CODE |
| HIGH | python/x402/tests/integrations/test_mcp_evm.py | 385 | except Exception: | CODE |
| HIGH | python/x402/mcp/server.py | 399 | except (ValueError, AttributeError): | CODE |
| HIGH | python/x402/mcp/server.py | 290 | except Exception: | CODE |
| HIGH | python/x402/mcp/server.py | 335 | except Exception: | CODE |
| HIGH | python/x402/mcp/client.py | 391 | except (json.JSONDecodeError, TypeError): | CODE |
| HIGH | python/x402/mcp/client.py | 401 | except (json.JSONDecodeError, TypeError): | CODE |
| HIGH | python/x402/mcp/utils.py | 243 | except (json.JSONDecodeError, TypeError): | CODE |
| HIGH | python/x402/mcp/server_sync.py | 312 | except Exception: | CODE |
| HIGH | python/x402/mcp/server_sync.py | 426 | except Exception: | CODE |
| HIGH | python/x402/mcp/server_sync.py | 388 | except Exception: | CODE |
| HIGH | python/x402/mcp/server_async.py | 459 | except Exception: | CODE |
| HIGH | python/x402/mcp/server_async.py | 583 | except Exception: | CODE |
| HIGH | python/x402/mcp/server_async.py | 539 | except Exception: | CODE |
| HIGH | …402/extensions/erc20_approval_gas_sponsoring/client.py | 66 | except Exception: | CODE |
| HIGH | python/x402/extensions/bazaar/facilitator.py | 305 | except ValueError: | CODE |
| HIGH | python/x402/http/utils.py | 111 | except (json.JSONDecodeError, UnicodeDecodeError): | CODE |
| HIGH | python/x402/http/x402_http_client_base.py | 216 | except ValueError: | CODE |
| HIGH | python/x402/http/x402_http_client_base.py | 202 | except json.JSONDecodeError: | CODE |
| HIGH | python/x402/http/x402_http_client_base.py | 226 | except ValueError: | CODE |
| HIGH | python/x402/http/x402_http_server_base.py | 1435 | except (ValueError, TypeError): | CODE |
| HIGH | python/x402/http/clients/httpx.py | 142 | except json.JSONDecodeError: | CODE |
| HIGH | python/x402/http/clients/requests.py | 134 | except (json.JSONDecodeError, UnicodeDecodeError): | CODE |
| HIGH | python/x402/http/middleware/_bazaar_utils.py | 85 | except ImportError: | CODE |
| HIGH | python/x402/http/middleware/_bazaar_utils.py | 153 | except Exception: | CODE |
| HIGH | python/x402/http/paywall/__init__.py | 121 | except (ValueError, TypeError): | CODE |
| 3 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | python/legacy/src/x402/common.py | 35 | Process a Price into atomic amount, asset address, and EIP-712 domain info Args: price: Either Money (USD s | STRING |
| HIGH | python/legacy/src/x402/clients/base.py | 92 | Select payment requirements from the list of accepted requirements. Args: accepts: List of accepted | STRING |
| HIGH | python/legacy/src/x402/clients/base.py | 138 | Select payment requirements using the configured selector. Args: accepts: List of accepted payment | STRING |
| HIGH | python/x402/server.py | 189 | Verify a payment via facilitator. Args: payload: Payment payload to verify. requirement | STRING |
| HIGH | python/x402/server.py | 258 | Settle a payment via facilitator. Args: payload: Payment payload to settle. requirement | STRING |
| HIGH | python/x402/server.py | 509 | Verify a payment via facilitator. Args: payload: Payment payload to verify. requirement | STRING |
| HIGH | python/x402/server.py | 578 | Settle a payment via facilitator. Args: payload: Payment payload to settle. requirement | STRING |
| HIGH | python/x402/facilitator_base.py | 384 | Core verify logic as generator. Yields (phase, hook, context) tuples for hook execution. The caller dri | STRING |
| HIGH | python/x402/facilitator_base.py | 491 | Core settle logic as generator. Yields (phase, hook, context) tuples for hook execution. The caller dri | STRING |
| HIGH | python/x402/client.py | 179 | Create a payment payload for the given 402 response. Args: payment_required: The 402 response from | STRING |
| HIGH | python/x402/client.py | 367 | Create a payment payload for the given 402 response. Args: payment_required: The 402 response from | STRING |
| HIGH | python/x402/facilitator.py | 126 | Verify a payment. Routes to V1 or V2 verification based on payload version. Args: payload: | STRING |
| HIGH | python/x402/facilitator.py | 163 | Settle a payment. Routes to V1 or V2 settlement based on payload version. Args: payload: P | STRING |
| HIGH | python/x402/facilitator.py | 280 | Verify a payment. Routes to V1 or V2 verification based on payload version. Args: payload: | STRING |
| HIGH | python/x402/facilitator.py | 317 | Settle a payment. Routes to V1 or V2 settlement based on payload version. Args: payload: P | STRING |
| HIGH | python/x402/mechanisms/svm/default_assets.py | 124 | Look up a default asset by network and optional ticker. Args: network: CAIP-2 or v1 network. symbol | STRING |
| HIGH | python/x402/mechanisms/svm/signers.py | 167 | Sign a partially-signed transaction. Supports both legacy and versioned (v0) transactions: - Legacy tra | STRING |
| HIGH | python/x402/mechanisms/svm/signers.py | 284 | Send a transaction. Args: tx_base64: Base64 encoded signed transaction. network: CAIP-2 | STRING |
| HIGH | python/x402/mechanisms/svm/utils.py | 52 | Normalize network identifier to CAIP-2 format. Handles both V1 names (solana, solana-devnet) and V2 CAIP-2 format. | STRING |
| HIGH | python/x402/mechanisms/svm/utils.py | 101 | Get the default USDC mint address for a network. Args: network: Network identifier (CAIP-2 or V1 format). | STRING |
| HIGH | python/x402/mechanisms/svm/utils.py | 125 | Get asset info for a network. Args: network: Network identifier. asset_address: Optional specific a | STRING |
| HIGH | python/x402/mechanisms/svm/utils.py | 202 | Decode a base64 encoded transaction from an SVM payload. Args: payload: The SVM payload containing a base64 | STRING |
| HIGH | python/x402/mechanisms/svm/signer.py | 74 | Sign a partially-signed transaction with the signer matching fee_payer. Transaction is decoded, signed, and re- | STRING |
| HIGH | python/x402/mechanisms/svm/signer.py | 104 | Send a signed transaction to the network. Args: tx_base64: Base64 encoded signed transaction. | STRING |
| HIGH | python/x402/mechanisms/svm/exact/server.py | 77 | Parse price into asset amount. If price is already AssetAmount, returns it directly. If price is Money | STRING |
| HIGH | python/x402/mechanisms/svm/exact/client.py | 88 | Create signed SPL TransferChecked inner payload. Args: requirements: Payment requirements from serv | STRING |
| HIGH | python/x402/mechanisms/svm/exact/v1/client.py | 92 | Create signed SPL TransferChecked inner payload (V1 format). Args: requirements: V1 payment require | STRING |
| HIGH | python/x402/mechanisms/evm/default_assets.py | 330 | Look up a default asset by network and optional ticker. Args: network: CAIP-2 or v1 network. symbol | STRING |
| HIGH | python/x402/mechanisms/evm/signers.py | 574 | Wait for a transaction to be mined. Bounded by `confirmation_timeout_seconds` from the constructor. Ar | STRING |
| HIGH | python/x402/mechanisms/evm/erc6492.py | 31 | Parse ERC-6492 wrapped signature. ERC-6492 Format: abi.encode((address factory, bytes factoryCalldata, byte | STRING |
| HIGH | python/x402/mechanisms/evm/utils.py | 22 | Extract chain ID from a CAIP-2 network identifier (eip155:CHAIN_ID). Args: network: Network identifier in C | STRING |
| HIGH | python/x402/mechanisms/evm/utils.py | 58 | Get asset info by address. Returns the full default asset info if the address matches a registered default. Ar | STRING |
| HIGH | python/x402/mechanisms/evm/utils.py | 119 | Normalize Ethereum address to checksummed format. Uses EIP-55 checksum algorithm. Args: address: Ether | STRING |
| HIGH | python/x402/mechanisms/evm/verify.py | 24 | Verify ECDSA signature from EOA. Uses secp256k1 public key recovery. Handles Ethereum v value adjustment (27/28 | STRING |
| HIGH | python/x402/mechanisms/evm/v1/utils.py | 10 | Extract chain ID from a v1 legacy network name. Args: network: V1 network name (e.g., "base-sepolia", "poly | STRING |
| HIGH | python/x402/mechanisms/evm/v1/utils.py | 28 | Get asset info for a v1 network by legacy network name. Args: network: V1 legacy network name (e.g., "base" | STRING |
| HIGH | python/x402/mechanisms/evm/exact/server.py | 63 | Parse price into asset amount. If price is already AssetAmount, returns it directly. If price is Money | STRING |
| HIGH | python/x402/mechanisms/evm/exact/server.py | 168 | Convert decimal amount to network's default stablecoin AssetAmount. Args: amount: Decimal amount as | STRING |
| HIGH | python/x402/mechanisms/evm/exact/client.py | 244 | Sign EIP-3009 authorization using EIP-712. Requires requirements.extra to contain 'name' and 'version' | STRING |
| HIGH | python/x402/mechanisms/tvm/default_assets.py | 39 | Look up a default asset by network and optional ticker. Args: network: CAIP-2 network. symbol: Tick | STRING |
| HIGH | python/x402/mcp/client_async.py | 155 | Call a tool with automatic payment handling. Args: name: Tool name args: Tool arguments | STRING |
| HIGH | python/x402/schemas/helpers.py | 14 | Extract x402Version from JSON bytes or dict. Args: data: JSON bytes or parsed dict. Returns: P | STRING |
| HIGH | python/x402/schemas/helpers.py | 44 | Extract scheme and network from payment payload. Args: version: Protocol version (1 or 2). payload: | STRING |
| HIGH | python/x402/schemas/helpers.py | 168 | Parse payment requirements based on protocol version. Unlike parse_payment_payload which auto-detects version from | STRING |
| HIGH | python/x402/schemas/helpers.py | 199 | Check if network matches a pattern (supports wildcards). Args: network: Specific network (e.g., "eip155:845 | STRING |
| HIGH | python/x402/schemas/helpers.py | 222 | Derive common pattern from list of networks. If all networks share same namespace, returns wildcard pattern. Ot | STRING |
| HIGH | python/x402/extensions/builder_code/server.py | 45 | Declare the builder-code extension for inclusion in PaymentRequired.extensions. Args: app_code: The service | STRING |
| HIGH | python/x402/extensions/builder_code/cbor.py | 200 | Build a complete ERC-8021 Schema 2 data suffix from builder code data. Format: ``[cbor_data][suffix_data_length (2 | STRING |
| HIGH | python/x402/extensions/bazaar/facilitator_client.py | 205 | List x402 discovery resources from the bazaar. Args: params: Optional filtering and pagination para | STRING |
| HIGH | python/x402/extensions/bazaar/facilitator_client.py | 275 | Search x402 discovery resources from the bazaar using a natural-language query. Pagination is optional: facilit | STRING |
| HIGH | python/x402/extensions/bazaar/facilitator.py | 774 | Extract discovery info from a v2 extension directly. This is a lower-level function for when you already have the e | STRING |
| HIGH | python/x402/extensions/payment_identifier/client.py | 15 | Append a payment identifier to the extensions object if the server declared support. This function reads the server | STRING |
| HIGH | python/x402/http/facilitator_client.py | 160 | Verify a payment with the facilitator (async). Args: payload: Payment payload to verify. | STRING |
| HIGH | python/x402/http/facilitator_client.py | 184 | Settle a payment with the facilitator (async). Args: payload: Payment payload to settle. | STRING |
| HIGH | python/x402/http/facilitator_client.py | 380 | Verify a payment with the facilitator. Args: payload: Payment payload to verify. requir | STRING |
| HIGH | python/x402/http/facilitator_client.py | 404 | Settle a payment with the facilitator. Args: payload: Payment payload to settle. requir | STRING |
| HIGH | python/x402/http/utils.py | 84 | Detect the x402 protocol version from HTTP response headers and body. Prioritizes V2 header, then V1 body. Arg | STRING |
| HIGH | python/x402/http/x402_http_client_base.py | 126 | Extract payment required from HTTP response. Handles both V1 (body) and V2 (header) formats. Args: | STRING |
| HIGH | python/x402/http/x402_http_client_base.py | 158 | Extract settlement response from HTTP headers. Args: get_header: Function to get header by name. | STRING |
| HIGH | python/x402/http/clients/requests.py | 96 | Send request with automatic 402 payment handling. Args: request: The prepared request. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/legacy/src/x402/exact.py | 106 | except Exception: | CODE |
| LOW | python/legacy/src/x402/flask/middleware.py | 162 | except Exception as e: | CODE |
| LOW | python/legacy/src/x402/flask/middleware.py | 253 | except Exception as e: | CODE |
| LOW | python/legacy/src/x402/flask/middleware.py | 322 | except Exception as e: | CODE |
| LOW | python/legacy/src/x402/clients/httpx.py | 74 | except Exception as e: | CODE |
| LOW | python/legacy/src/x402/clients/requests.py | 82 | except Exception as e: | CODE |
| LOW | python/legacy/src/x402/fastapi/middleware.py | 86 | except Exception as e: | CODE |
| LOW | python/legacy/src/x402/fastapi/middleware.py | 171 | except Exception as e: | CODE |
| LOW | python/legacy/src/x402/fastapi/middleware.py | 218 | except Exception: | CODE |
| LOW⚡ | python/x402/server.py | 236 | except Exception as e: | CODE |
| LOW⚡ | python/x402/server.py | 556 | except Exception as e: | CODE |
| LOW | python/x402/server.py | 335 | except Exception as error: | CODE |
| LOW | python/x402/server.py | 361 | except Exception as error: | CODE |
| LOW | python/x402/server.py | 656 | except Exception as error: | CODE |
| LOW | python/x402/server.py | 686 | except Exception as error: | CODE |
| LOW | python/x402/server_base.py | 791 | except Exception as hook_error: | CODE |
| LOW | python/x402/server_base.py | 829 | except Exception as hook_error: | CODE |
| LOW | python/x402/server_base.py | 891 | except Exception as hook_error: | CODE |
| LOW | python/x402/server_base.py | 929 | except Exception as hook_error: | CODE |
| LOW | python/x402/server_base.py | 968 | except Exception as hook_error: | CODE |
| LOW | python/x402/server_base.py | 989 | except Exception as hook_error: | CODE |
| LOW | python/x402/server_base.py | 1028 | except Exception as hook_error: | CODE |
| LOW | python/x402/server_base.py | 1049 | except Exception as hook_error: | CODE |
| LOW | python/x402/server_base.py | 1483 | except Exception as e: | CODE |
| LOW | python/x402/server_base.py | 1734 | except Exception as e: | CODE |
| LOW | python/x402/facilitator_base.py | 468 | except Exception as e: | CODE |
| LOW | python/x402/facilitator_base.py | 575 | except Exception as e: | CODE |
| LOW | python/x402/client.py | 241 | except Exception as hook_error: | CODE |
| LOW | python/x402/client.py | 426 | except Exception as hook_error: | CODE |
| LOW | python/x402/client_base.py | 865 | except Exception as e: | CODE |
| LOW | python/x402/client_base.py | 953 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/svm/utils.py | 216 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/svm/exact/server.py | 159 | except Exception: | CODE |
| LOW⚡ | python/x402/mechanisms/svm/exact/facilitator.py | 183 | except Exception: | CODE |
| LOW⚡ | python/x402/mechanisms/svm/exact/facilitator.py | 358 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 397 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 425 | except Exception: | CODE |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 459 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 473 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 521 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 524 | except Exception as store_error: | CODE |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 550 | except Exception: | CODE |
| LOW | python/x402/mechanisms/svm/exact/v1/facilitator.py | 159 | except Exception: | CODE |
| LOW | python/x402/mechanisms/svm/exact/v1/facilitator.py | 330 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/svm/exact/v1/facilitator.py | 408 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/evm/multicall.py | 107 | except Exception as exc: | CODE |
| LOW | python/x402/mechanisms/evm/multicall.py | 134 | except Exception: | CODE |
| LOW | python/x402/mechanisms/evm/multicall.py | 140 | except Exception: | CODE |
| LOW | python/x402/mechanisms/evm/asset_cache.py | 131 | except Exception as exc: | CODE |
| LOW | python/x402/mechanisms/evm/signers.py | 492 | except Exception: | CODE |
| LOW | python/x402/mechanisms/evm/signers.py | 497 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/evm/settle_receipt.py | 82 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/evm/settle_receipt.py | 97 | except Exception: | CODE |
| LOW | python/x402/mechanisms/evm/settle_receipt.py | 106 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/evm/settle_receipt.py | 143 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/evm/erc6492.py | 76 | except Exception as e: | CODE |
| LOW | python/x402/mechanisms/evm/verify.py | 65 | except Exception: | CODE |
| LOW | python/x402/mechanisms/evm/verify.py | 105 | except Exception: | CODE |
| LOW | python/x402/mechanisms/evm/verify.py | 267 | except Exception: | CODE |
| LOW | python/x402/mechanisms/evm/upto/client.py | 132 | except Exception: | CODE |
| 202 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | go/client.go | 363 | // Step 1: Filter to supported (use wildcard matching helper) | COMMENT |
| LOW | go/client.go | 382 | // Step 2: Drop unrecognized paymentFlow values | COMMENT |
| LOW⚡ | go/client.go | 403 | // Step 3: Apply spend controls | COMMENT |
| LOW⚡ | go/client.go | 409 | // Step 4: Apply policies | COMMENT |
| LOW | go/client.go | 420 | // Step 5: Prefer authorization when both post- and pre-handler flows remain | COMMENT |
| LOW | go/client.go | 436 | // Step 6: Select final and convert back | COMMENT |
| LOW | go/mechanisms/svm/exact/v1/facilitator/scheme.go | 87 | // Step 1: Validate Payment Requirements | COMMENT |
| LOW | go/mechanisms/svm/exact/v1/facilitator/scheme.go | 139 | // Step 2: Parse and Validate Transaction Structure | COMMENT |
| LOW | go/mechanisms/svm/exact/v1/facilitator/scheme.go | 164 | // Step 3: Verify Compute Budget Instructions | COMMENT |
| LOW⚡ | go/mechanisms/svm/exact/v1/facilitator/scheme.go | 179 | // Step 4: Verify Transfer Instruction | COMMENT |
| LOW⚡ | go/mechanisms/svm/exact/v1/facilitator/scheme.go | 184 | // Step 5: Verify optional instructions (if present) | COMMENT |
| LOW | go/mechanisms/svm/exact/v1/facilitator/scheme.go | 240 | // Step 6: Simulate Transaction | COMMENT |
| LOW | go/mechanisms/svm/exact/facilitator/scheme.go | 169 | // Step 1: Validate Payment Requirements | COMMENT |
| LOW | go/mechanisms/svm/exact/facilitator/scheme.go | 212 | // Step 2: Parse and Validate Transaction Structure | COMMENT |
| LOW | go/mechanisms/svm/exact/facilitator/scheme.go | 366 | // Step 3: Verify Compute Budget Instructions | COMMENT |
| LOW⚡ | go/mechanisms/svm/exact/facilitator/scheme.go | 394 | // Step 4: Verify Transfer Instruction | COMMENT |
| LOW⚡ | go/mechanisms/svm/exact/facilitator/scheme.go | 399 | // Step 5: Verify optional instructions (if present) | COMMENT |
| LOW | go/mechanisms/svm/exact/facilitator/scheme.go | 456 | // Step 6: Simulate Transaction | COMMENT |
| LOW⚡ | go/mechanisms/evm/verify_universal.go | 48 | // Step 1: Parse ERC-6492 wrapper if present | COMMENT |
| LOW⚡ | go/mechanisms/evm/verify_universal.go | 54 | // Step 2: Always fetch code first. Routing is determined by whether the address | COMMENT |
| LOW | go/mechanisms/evm/verify_universal.go | 68 | // Step 5: Handle undeployed address | COMMENT |
| LOW | go/mechanisms/evm/verify_universal.go | 94 | // Step 6: Deployed smart contract - use EIP-1271 verification | COMMENT |
| LOW⚡ | python/x402/mechanisms/svm/exact/facilitator.py | 180 | # Step 2: Parse and Validate Transaction Structure | COMMENT |
| LOW⚡ | python/x402/mechanisms/svm/exact/facilitator.py | 348 | # Step 5: Sign and Simulate Transaction | COMMENT |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 161 | # Step 1: Validate Payment Requirements | COMMENT |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 198 | # Step 3: Verify Compute Budget Instructions | COMMENT |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 245 | # Step 4: Verify Transfer Instruction | COMMENT |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 258 | # Step 5: Verify optional instructions (if present) | COMMENT |
| LOW⚡ | specs/CONTRIBUTING.md | 71 | ### Step 1: Open a Discussion | COMMENT |
| LOW⚡ | specs/CONTRIBUTING.md | 79 | ### Step 2: Write the Spec | COMMENT |
| LOW⚡ | specs/CONTRIBUTING.md | 89 | ### Step 3: Submit PR | COMMENT |
| LOW | specs/schemes/auth-capture/scheme_auth_capture_evm.md | 765 | #### Step 1: the operator as a signature wrapper | COMMENT |
| LOW | specs/schemes/auth-capture/scheme_auth_capture_evm.md | 795 | #### Step 2: read-only policy hooks | COMMENT |
| LOW | specs/schemes/auth-capture/scheme_auth_capture_evm.md | 820 | #### Step 3: an example policy | COMMENT |
| LOW⚡ | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 250 | // Step 2: Parse transaction envelope to extract the operation | COMMENT |
| LOW⚡ | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 255 | // Step 3: Extract operation | COMMENT |
| LOW⚡ | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 258 | // Step 4: Rebuild transaction with facilitator as source and simulation-derived fee | COMMENT |
| LOW⚡ | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 455 | // Step 4: Extract and validate contract invocation details | COMMENT |
| LOW⚡ | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 463 | // Step 5: Validate contract address and function name | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 225 | // Step 1: Verify payment before settlement | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 290 | // Step 5: Sign inner transaction with the selected signer's key | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 305 | // Step 6: Optionally wrap in a fee bump transaction | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 343 | // Step 7: Submit transaction to network | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 356 | // Step 8: Poll for transaction confirmation | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 371 | // Step 9: Return success | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 403 | // Step 1: Validate protocol version, scheme, and network | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 422 | // Step 2: Parse and decode transaction | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 436 | // Step 3: Validate transaction structure | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 481 | // Step 6: Extract and validate transfer arguments | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 511 | // Step 7: Re-simulate to ensure transaction will succeed | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 524 | // Step 8: Validate the simulation-derived settlement fee against the safety ceiling | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 537 | // Step 9: Validate simulation events for expected transfer only. | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 556 | // Step 10: Validate auth entries (structure, credential type, expiration, facilitator safety, and signature statu | COMMENT |
| LOW⚡ | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 78 | // Step 2: Verify x402Version is 2 | COMMENT |
| LOW⚡ | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 87 | // Step 3: Verify the network matches | COMMENT |
| LOW | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 101 | // Step 4: Deserialize the BCS-encoded transaction and verify the signature | COMMENT |
| LOW | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 210 | // Step 5: Verify the transaction has not expired | COMMENT |
| LOW | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 221 | // Step 6: Verify the transaction contains a fungible asset transfer operation | COMMENT |
| LOW⚡ | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 276 | // Step 7: Verify the transfer is for the correct asset | COMMENT |
| LOW⚡ | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 286 | // Step 8: Verify the transfer amount matches | COMMENT |
| 77 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | go/client.go | 363 | // Step 1: Filter to supported (use wildcard matching helper) | COMMENT |
| LOW | go/client.go | 382 | // Step 2: Drop unrecognized paymentFlow values | COMMENT |
| LOW⚡ | go/client.go | 403 | // Step 3: Apply spend controls | COMMENT |
| LOW⚡ | go/client.go | 409 | // Step 4: Apply policies | COMMENT |
| LOW | go/client.go | 420 | // Step 5: Prefer authorization when both post- and pre-handler flows remain | COMMENT |
| LOW | go/client.go | 436 | // Step 6: Select final and convert back | COMMENT |
| LOW | go/mechanisms/svm/exact/v1/facilitator/scheme.go | 87 | // Step 1: Validate Payment Requirements | COMMENT |
| LOW | go/mechanisms/svm/exact/v1/facilitator/scheme.go | 139 | // Step 2: Parse and Validate Transaction Structure | COMMENT |
| LOW | go/mechanisms/svm/exact/v1/facilitator/scheme.go | 164 | // Step 3: Verify Compute Budget Instructions | COMMENT |
| LOW⚡ | go/mechanisms/svm/exact/v1/facilitator/scheme.go | 179 | // Step 4: Verify Transfer Instruction | COMMENT |
| LOW⚡ | go/mechanisms/svm/exact/v1/facilitator/scheme.go | 184 | // Step 5: Verify optional instructions (if present) | COMMENT |
| LOW | go/mechanisms/svm/exact/v1/facilitator/scheme.go | 240 | // Step 6: Simulate Transaction | COMMENT |
| LOW | go/mechanisms/svm/exact/facilitator/scheme.go | 169 | // Step 1: Validate Payment Requirements | COMMENT |
| LOW | go/mechanisms/svm/exact/facilitator/scheme.go | 212 | // Step 2: Parse and Validate Transaction Structure | COMMENT |
| LOW | go/mechanisms/svm/exact/facilitator/scheme.go | 366 | // Step 3: Verify Compute Budget Instructions | COMMENT |
| LOW⚡ | go/mechanisms/svm/exact/facilitator/scheme.go | 394 | // Step 4: Verify Transfer Instruction | COMMENT |
| LOW⚡ | go/mechanisms/svm/exact/facilitator/scheme.go | 399 | // Step 5: Verify optional instructions (if present) | COMMENT |
| LOW | go/mechanisms/svm/exact/facilitator/scheme.go | 456 | // Step 6: Simulate Transaction | COMMENT |
| LOW⚡ | go/mechanisms/evm/verify_universal.go | 48 | // Step 1: Parse ERC-6492 wrapper if present | COMMENT |
| LOW⚡ | go/mechanisms/evm/verify_universal.go | 54 | // Step 2: Always fetch code first. Routing is determined by whether the address | COMMENT |
| LOW | go/mechanisms/evm/verify_universal.go | 68 | // Step 5: Handle undeployed address | COMMENT |
| LOW | go/mechanisms/evm/verify_universal.go | 94 | // Step 6: Deployed smart contract - use EIP-1271 verification | COMMENT |
| LOW⚡ | python/x402/mechanisms/svm/exact/facilitator.py | 180 | # Step 2: Parse and Validate Transaction Structure | COMMENT |
| LOW⚡ | python/x402/mechanisms/svm/exact/facilitator.py | 348 | # Step 5: Sign and Simulate Transaction | COMMENT |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 161 | # Step 1: Validate Payment Requirements | COMMENT |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 198 | # Step 3: Verify Compute Budget Instructions | COMMENT |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 245 | # Step 4: Verify Transfer Instruction | COMMENT |
| LOW | python/x402/mechanisms/svm/exact/facilitator.py | 258 | # Step 5: Verify optional instructions (if present) | COMMENT |
| LOW⚡ | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 250 | // Step 2: Parse transaction envelope to extract the operation | COMMENT |
| LOW⚡ | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 255 | // Step 3: Extract operation | COMMENT |
| LOW⚡ | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 258 | // Step 4: Rebuild transaction with facilitator as source and simulation-derived fee | COMMENT |
| LOW⚡ | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 455 | // Step 4: Extract and validate contract invocation details | COMMENT |
| LOW⚡ | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 463 | // Step 5: Validate contract address and function name | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 225 | // Step 1: Verify payment before settlement | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 290 | // Step 5: Sign inner transaction with the selected signer's key | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 305 | // Step 6: Optionally wrap in a fee bump transaction | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 343 | // Step 7: Submit transaction to network | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 356 | // Step 8: Poll for transaction confirmation | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 371 | // Step 9: Return success | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 403 | // Step 1: Validate protocol version, scheme, and network | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 422 | // Step 2: Parse and decode transaction | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 436 | // Step 3: Validate transaction structure | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 481 | // Step 6: Extract and validate transfer arguments | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 511 | // Step 7: Re-simulate to ensure transaction will succeed | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 524 | // Step 8: Validate the simulation-derived settlement fee against the safety ceiling | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 537 | // Step 9: Validate simulation events for expected transfer only. | COMMENT |
| LOW | …ges/mechanisms/stellar/src/exact/facilitator/scheme.ts | 556 | // Step 10: Validate auth entries (structure, credential type, expiration, facilitator safety, and signature statu | COMMENT |
| LOW⚡ | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 78 | // Step 2: Verify x402Version is 2 | COMMENT |
| LOW⚡ | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 87 | // Step 3: Verify the network matches | COMMENT |
| LOW | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 101 | // Step 4: Deserialize the BCS-encoded transaction and verify the signature | COMMENT |
| LOW | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 210 | // Step 5: Verify the transaction has not expired | COMMENT |
| LOW | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 221 | // Step 6: Verify the transaction contains a fungible asset transfer operation | COMMENT |
| LOW⚡ | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 276 | // Step 7: Verify the transfer is for the correct asset | COMMENT |
| LOW⚡ | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 286 | // Step 8: Verify the transfer amount matches | COMMENT |
| LOW⚡ | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 296 | // Step 9: Verify the transfer recipient matches | COMMENT |
| LOW⚡ | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 306 | // Step 10: Verify the sender has sufficient balance | COMMENT |
| LOW | …kages/mechanisms/aptos/src/exact/facilitator/scheme.ts | 325 | // Step 11: Simulate the transaction | COMMENT |
| LOW | …ages/mechanisms/svm/src/exact/v1/facilitator/scheme.ts | 114 | // Step 1: Validate Payment Requirements | COMMENT |
| LOW | …ages/mechanisms/svm/src/exact/v1/facilitator/scheme.ts | 149 | // Step 2: Parse and Validate Transaction Structure | COMMENT |
| LOW | …ages/mechanisms/svm/src/exact/v1/facilitator/scheme.ts | 213 | // Step 3: Verify Compute Budget Instructions | COMMENT |
| 71 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | go/facilitator_hooks.go | 81 | COMMENT | |
| LOW | go/facilitator_hooks.go | 101 | // If it returns a result with Abort=true, settlement will be aborted | COMMENT |
| LOW | go/server.go | 341 | if !ok { | COMMENT |
| LOW | go/server.go | 621 | // CreatePaymentCancellationDispatcherWithExtensions returns a dispatcher | COMMENT |
| LOW | go/server.go | 1101 | // field past the sum of every party's own reservation and later crowd out a | COMMENT |
| LOW | go/server.go | 1341 | COMMENT | |
| LOW | go/server.go | 1401 | func (s *x402ResourceServer) SettlePayment(ctx context.Context, payload types.PaymentPayload, requirements types.Payment | COMMENT |
| LOW | go/server_hooks.go | 41 | // SkipHandlerDirective is an optional acknowledgement body returned to the caller | COMMENT |
| LOW | go/server_hooks.go | 261 | type SettleFailureHookResult struct { | COMMENT |
| LOW | go/server_hooks.go | 281 | // handler and perform settlement inline (e.g. cooperative refund). | COMMENT |
| LOW | go/server_hooks.go | 361 | } | COMMENT |
| LOW | go/server_hooks.go | 421 | // needs to enrich settlement payload (pre-facilitator) or settlement | COMMENT |
| LOW | go/server_hooks.go | 441 | // for nested maps) before deep-merging. | COMMENT |
| LOW | go/interfaces.go | 1 | package x402 | COMMENT |
| LOW | go/interfaces.go | 41 | // Examples: | COMMENT |
| LOW | go/interfaces.go | 61 | // which addresses might sign/pay for transactions. | COMMENT |
| LOW | go/interfaces.go | 121 | COMMENT | |
| LOW | go/interfaces.go | 141 | // automatically — user code does not need to update local channel state manually. | COMMENT |
| LOW | go/interfaces.go | 301 | type SchemeNetworkFacilitator interface { | COMMENT |
| LOW | go/interfaces.go | 321 | // Returns: | COMMENT |
| LOW | go/pending_settlement_store.go | 21 | // the same payload (typically the resource server's single automatic retry — | COMMENT |
| LOW | go/.golangci.yml | 41 | # Report unused function parameters | COMMENT |
| LOW | go/client_hooks.go | 61 | type BeforePaymentCreationHook func(PaymentCreationContext) (*BeforePaymentCreationHookResult, error) | COMMENT |
| LOW | go/errors.go | 81 | } | COMMENT |
| LOW | go/errors.go | 121 | } | COMMENT |
| LOW | go/mechanisms/svm/types.go | 41 | // ChannelId is the channel PDA (base58). | COMMENT |
| LOW | go/mechanisms/svm/types.go | 201 | } | COMMENT |
| LOW | go/mechanisms/svm/pending_settlement.go | 1 | package svm | COMMENT |
| LOW | go/mechanisms/svm/upto/facilitator/rent_cleanup.go | 181 | // cleanup transactions. Unset defaults to paymentchannels.DefaultSettleComputeUnitLimit | COMMENT |
| LOW | go/mechanisms/svm/upto/facilitator/scheme.go | 41 | // OnStorageError is called when reverting a failed open fails. The settle | COMMENT |
| LOW | go/mechanisms/svm/upto/facilitator/scheme.go | 61 | MaxRequiredSignatures *int | COMMENT |
| LOW | go/mechanisms/svm/upto/facilitator/scheme.go | 81 | // Advertised as /supported extra.receiverAuthorizer and used to sign claim | COMMENT |
| LOW | go/mechanisms/svm/upto/facilitator/scheme.go | 121 | Payload types.PaymentPayload | COMMENT |
| LOW | go/mechanisms/svm/upto/facilitator/errors.go | 41 | // ErrOpenTransaction is returned when the open transaction fails the acceptance policy. | COMMENT |
| LOW | go/mechanisms/svm/upto/facilitator/errors.go | 61 | // identity is missing, unresolved, or not the deposit-time binding. | COMMENT |
| LOW | go/mechanisms/svm/upto/facilitator/errors.go | 81 | // simulation fails, so the deposit is never escrowed. | COMMENT |
| LOW | go/mechanisms/svm/exact/server/scheme.go | 61 | return map[string]x402.PaymentFlowConfig{ | COMMENT |
| LOW | go/mechanisms/svm/exact/server/scheme.go | 81 | // The server instance for chaining | COMMENT |
| LOW | go/mechanisms/svm/exact/server/scheme.go | 101 | // ParsePrice parses a price and converts it to an asset amount (V2) | COMMENT |
| LOW | go/mechanisms/svm/exact/facilitator/errors.go | 61 | ErrSmartWalletMultipleMatchingTransfers = "invalid_exact_solana_smart_wallet_multiple_matching_transfers" | COMMENT |
| LOW | go/mechanisms/svm/paymentchannels/onchain.go | 41 | // plus the nonce and binding memos can exceed 110,000 CU; 200,000 leaves | COMMENT |
| LOW | go/mechanisms/svm/paymentchannels/storage.go | 21 | Network string | COMMENT |
| LOW | go/mechanisms/svm/paymentchannels/storage.go | 41 | } | COMMENT |
| LOW | go/mechanisms/svm/paymentchannels/storage.go | 61 | // differs from the requested non-empty value, RecordOpen MUST leave the | COMMENT |
| LOW | go/mechanisms/svm/paymentchannels/facilitator.go | 21 | COMMENT | |
| LOW | go/mechanisms/evm/eip712_test.go | 1 | package evm | COMMENT |
| LOW | go/mechanisms/evm/types.go | 261 | SendTransaction(ctx context.Context, to string, data []byte) (string, error) | COMMENT |
| LOW | go/mechanisms/evm/verify_1271.go | 21 | // This is bytes4(keccak256("isValidSignature(bytes32,bytes)")) | COMMENT |
| LOW | go/mechanisms/evm/verify_universal.go | 1 | package evm | COMMENT |
| LOW | go/mechanisms/evm/verify_universal.go | 21 | // 3. If undeployed + has deployment info + allowUndeployed: classify as counterfactual, | COMMENT |
| LOW | go/mechanisms/evm/utils.go | 101 | // WaitForSettleReceiptWithPendingStore wraps WaitForSettleReceipt with the | COMMENT |
| LOW | go/mechanisms/evm/erc6492.go | 21 | // | COMMENT |
| LOW | go/mechanisms/evm/erc6492.go | 41 | // | COMMENT |
| LOW | go/mechanisms/evm/verify_eoa.go | 1 | package evm | COMMENT |
| LOW | go/mechanisms/evm/eip712.go | 101 | digest := crypto.Keccak256(rawData) | COMMENT |
| LOW | go/mechanisms/evm/eip712.go | 261 | // HashPermit2Authorization hashes a PermitWitnessTransferFrom message for Permit2. | COMMENT |
| LOW | go/mechanisms/evm/auth-capture/server/scheme.go | 21 | // when Config.CaptureDeadline is zero. | COMMENT |
| LOW | go/mechanisms/evm/auth-capture/facilitator/scheme.go | 21 | // OperatorAllowlistEntry admits a contract operator, or every one with OperatorAddressWildcard, | COMMENT |
| LOW | go/mechanisms/evm/auth-capture/facilitator/scheme.go | 41 | // FeeRecipient, MinFeeBps and MaxFeeBps are the fee terms advertised in /supported; omit for no fee. | COMMENT |
| LOW | go/mechanisms/evm/auth-capture/facilitator/scheme.go | 61 | COMMENT | |
| 122 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | python/legacy/tests/test_common.py | 71 | # Create a test TokenAmount | COMMENT |
| MEDIUM | python/legacy/tests/clients/test_requests.py | 85 | # Create a prepared request | COMMENT |
| MEDIUM | python/legacy/tests/clients/test_requests.py | 101 | # Create a prepared request | COMMENT |
| MEDIUM | python/legacy/tests/clients/test_requests.py | 117 | # Create a prepared request | COMMENT |
| MEDIUM | python/legacy/tests/clients/test_requests.py | 163 | # Create a prepared request | COMMENT |
| MEDIUM | python/legacy/tests/clients/test_requests.py | 225 | # Create a prepared request | COMMENT |
| MEDIUM | python/legacy/tests/clients/test_requests.py | 243 | # Create a prepared request | COMMENT |
| MEDIUM | python/legacy/src/x402/paywall.py | 80 | # Create the window.x402 configuration object | COMMENT |
| MEDIUM | python/legacy/src/x402/paywall.py | 106 | # Create the configuration script | COMMENT |
| MEDIUM | python/x402/mechanisms/svm/exact/client.py | 185 | # Create a partially-signed transaction | COMMENT |
| MEDIUM | python/x402/mechanisms/svm/exact/v1/client.py | 191 | # Create a partially-signed transaction | COMMENT |
| MEDIUM | python/x402/tests/unit/extensions/test_exports.py | 55 | # Create a new namespace | COMMENT |
| MEDIUM | python/x402/tests/integrations/test_core.py | 395 | # Create a valid client to make payload | COMMENT |
| MEDIUM | python/x402/tests/integrations/test_evm.py | 622 | # Create a simple typed data message | COMMENT |
| MEDIUM | python/x402/tests/integrations/test_svm.py | 406 | # Create a mock facilitator for the server | COMMENT |
| MEDIUM | python/x402/mcp/tests/test_server_async.py | 29 | # Create an AsyncMock that wraps the real method so we can track calls | COMMENT |
| MEDIUM | python/x402/mcp/tests/test_server.py | 34 | # Create a Mock that wraps the real method so we can track calls | COMMENT |
| MEDIUM | python/x402/mcp/tests/test_client.py | 37 | # Create a mock result object with attributes (not dict) since _convert_mcp_result uses getattr | COMMENT |
| MEDIUM | python/x402/mcp/tests/test_client.py | 270 | # Create a mock result object with payment response | COMMENT |
| MEDIUM | python/x402/http/clients/requests.py | 155 | # Create a copy of the request for retry (don't modify original) | COMMENT |
| MEDIUM⚡ | examples/python/servers/mcp/simple.py | 97 | # Create the paid tool bridge (SDK handles _meta extraction + CallToolResult conversion) | COMMENT |
| MEDIUM | e2e/legacy/clients/python/http/requests/build.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/legacy/clients/python/http/requests/main.py | 25 | # Create a session and mount the x402 adapter | COMMENT |
| MEDIUM | e2e/legacy/clients/python/http/httpx/build.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/legacy/clients/typescript/http/fetch/install.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/legacy/clients/typescript/http/fetch/build.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/legacy/clients/typescript/http/axios/install.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/legacy/clients/typescript/http/axios/build.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/legacy/servers/python/http/flask/build.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/legacy/servers/python/http/fastapi/build.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/legacy/servers/typescript/http/next/install.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/legacy/servers/typescript/http/next/build.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/legacy/servers/typescript/http/express/install.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/legacy/servers/typescript/http/express/build.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/legacy/servers/typescript/http/hono/install.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/legacy/servers/typescript/http/hono/build.sh | 3 | # This file is intentionally empty | COMMENT |
| MEDIUM | e2e/servers/typescript/http/next/install.sh | 3 | # This file is intentionally empty | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/legacy/src/x402/clients/__init__.py | 12 | __all__ = [ | CODE |
| LOW | python/legacy/src/x402/fastapi/middleware.py | 29 | logger = logging.getLogger(__name__) | CODE |
| LOW⚡ | python/x402/server.py | 52 | __all__ = [ | CODE |
| LOW | python/x402/pending_settlement_store.py | 134 | __all__ = [ | CODE |
| LOW | python/x402/client.py | 52 | __all__ = [ | CODE |
| LOW | python/x402/__init__.py | 178 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/svm/__init__.py | 95 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/svm/exact/__init__.py | 15 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/svm/exact/v1/__init__.py | 9 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/evm/__init__.py | 124 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/evm/upto/__init__.py | 14 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/evm/batch_settlement/encoding.py | 104 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/evm/batch_settlement/__init__.py | 59 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/evm/batch_settlement/utils.py | 144 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/evm/batch_settlement/abi.py | 224 | __all__ = [ | CODE |
| LOW | …/x402/mechanisms/evm/batch_settlement/storage_utils.py | 64 | __all__ = ["resolve_within_dir", "read_json_file", "write_json_atomic", "delete_file"] | CODE |
| LOW | …2/mechanisms/evm/batch_settlement/authorizer_signer.py | 122 | __all__ = [ | CODE |
| LOW | …/evm/batch_settlement/server/channel_manager_common.py | 238 | __all__ = [ | CODE |
| LOW | …/x402/mechanisms/evm/batch_settlement/server/settle.py | 375 | __all__ = [ | CODE |
| LOW | …402/mechanisms/evm/batch_settlement/server/__init__.py | 35 | __all__ = [ | CODE |
| LOW | …ms/evm/batch_settlement/server/channel_manager_sync.py | 327 | def _update_claimed_sessions(self, claims: list) -> None: | CODE |
| LOW | …ms/evm/batch_settlement/server/channel_manager_sync.py | 356 | __all__ = ["BatchSettlementChannelManagerSync", "ChannelManagerConfigSync"] | CODE |
| LOW | …n/x402/mechanisms/evm/batch_settlement/server/utils.py | 92 | __all__ = [ | CODE |
| LOW | …mechanisms/evm/batch_settlement/server/file_storage.py | 124 | __all__ = ["FileChannelStorage", "FileChannelStorageOptions"] | CODE |
| LOW | …x402/mechanisms/evm/batch_settlement/server/storage.py | 185 | __all__ = [ | CODE |
| LOW | …/x402/mechanisms/evm/batch_settlement/server/verify.py | 486 | __all__ = [ | CODE |
| LOW | …hanisms/evm/batch_settlement/server/channel_manager.py | 337 | def _update_claimed_sessions(self, claims: list[VoucherClaim]) -> None: | CODE |
| LOW | …hanisms/evm/batch_settlement/server/channel_manager.py | 372 | __all__ = [ | CODE |
| LOW | …/x402/mechanisms/evm/batch_settlement/server/scheme.py | 490 | __all__ = [ | CODE |
| LOW | …mechanisms/evm/batch_settlement/facilitator/deposit.py | 848 | __all__ = ["verify_deposit", "settle_deposit"] | CODE |
| LOW | …/mechanisms/evm/batch_settlement/facilitator/settle.py | 163 | __all__ = ["execute_settle"] | CODE |
| LOW | …echanisms/evm/batch_settlement/facilitator/__init__.py | 5 | __all__ = ["BatchSettlementEvmFacilitator", "BatchSettlementEvmFacilitatorConfig"] | CODE |
| LOW | …2/mechanisms/evm/batch_settlement/facilitator/claim.py | 119 | __all__ = ["build_voucher_claim_args", "execute_claim_with_signature"] | CODE |
| LOW | …2/mechanisms/evm/batch_settlement/facilitator/utils.py | 241 | __all__ = [ | CODE |
| LOW | …ms/evm/batch_settlement/facilitator/deposit_permit2.py | 333 | __all__ = [ | CODE |
| LOW | …mechanisms/evm/batch_settlement/facilitator/voucher.py | 117 | __all__ = ["verify_voucher"] | CODE |
| LOW | …ms/evm/batch_settlement/facilitator/deposit_eip3009.py | 186 | __all__ = [ | CODE |
| LOW | …/mechanisms/evm/batch_settlement/facilitator/scheme.py | 208 | __all__ = ["BatchSettlementEvmFacilitator"] | CODE |
| LOW | …/mechanisms/evm/batch_settlement/facilitator/refund.py | 309 | __all__ = ["execute_refund_with_signature"] | CODE |
| LOW | …n/x402/mechanisms/evm/batch_settlement/client/hooks.py | 79 | __all__ = [ | CODE |
| LOW | …/x402/mechanisms/evm/batch_settlement/client/config.py | 211 | __all__ = [ | CODE |
| LOW | …402/mechanisms/evm/batch_settlement/client/recovery.py | 156 | __all__ = [ | CODE |
| LOW | …x402/mechanisms/evm/batch_settlement/client/channel.py | 285 | __all__ = [ | CODE |
| LOW | …402/mechanisms/evm/batch_settlement/client/__init__.py | 48 | __all__ = [ | CODE |
| LOW | …x402/mechanisms/evm/batch_settlement/client/eip3009.py | 100 | __all__ = ["create_batch_settlement_eip3009_deposit_payload"] | CODE |
| LOW | …mechanisms/evm/batch_settlement/client/file_storage.py | 48 | __all__ = ["FileChannelStorageOptions", "FileClientChannelStorage"] | CODE |
| LOW | …x402/mechanisms/evm/batch_settlement/client/permit2.py | 99 | __all__ = ["create_batch_settlement_permit2_deposit_payload"] | CODE |
| LOW | …x402/mechanisms/evm/batch_settlement/client/storage.py | 107 | __all__ = [ | CODE |
| LOW | …x402/mechanisms/evm/batch_settlement/client/voucher.py | 44 | __all__ = ["sign_voucher"] | CODE |
| LOW | …/x402/mechanisms/evm/batch_settlement/client/scheme.py | 390 | __all__ = ["BatchSettlementEvmScheme"] | CODE |
| LOW | …/x402/mechanisms/evm/batch_settlement/client/refund.py | 298 | __all__ = ["RefundOptions", "refund_channel"] | CODE |
| LOW | python/x402/mechanisms/evm/exact/__init__.py | 16 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/evm/exact/facilitator.py | 67 | logger = logging.getLogger(__name__) | CODE |
| LOW | python/x402/mechanisms/evm/exact/v1/__init__.py | 10 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/tvm/provider.py | 42 | logger = logging.getLogger(__name__) | CODE |
| LOW | python/x402/mechanisms/tvm/__init__.py | 118 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/tvm/utils.py | 42 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/tvm/codecs/__init__.py | 38 | __all__ = [ | CODE |
| LOW | python/x402/mechanisms/tvm/exact/__init__.py | 9 | __all__ = [ | CODE |
| LOW | …m/batch_settlement/facilitator/test_charge_baseline.py | 77 | def set_state(balance: int, total_claimed: int) -> None: | CODE |
| 29 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …/packages/mechanisms/evm/test/unit/upto/client.test.ts | 69 | expect(result.payload.permit2Authorization.witness.to.toLowerCase()).toBe( | CODE |
| CRITICAL | …/packages/mechanisms/evm/test/unit/upto/client.test.ts | 77 | expect(result.payload.permit2Authorization.witness.facilitator.toLowerCase()).toBe( | CODE |
| CRITICAL | …/packages/mechanisms/evm/test/unit/upto/client.test.ts | 324 | expect(result.payload.permit2Authorization.witness.facilitator.toLowerCase()).toBe( | CODE |
| CRITICAL | …packages/mechanisms/evm/test/unit/exact/client.test.ts | 360 | expect(result.payload.permit2Authorization.witness.to.toLowerCase()).toBe( | CODE |
| CRITICAL | …a/src/test/java/org/x402/server/PaymentFilterTest.java | 418 | org.junit.jupiter.api.Assertions.assertTrue(jsonString.contains("\"payer\":\"" + payerAddress + "\""), | CODE |
| CRITICAL | …a/src/test/java/org/x402/server/PaymentFilterTest.java | 420 | org.junit.jupiter.api.Assertions.assertTrue(jsonString.contains("\"success\":true"), | CODE |
| CRITICAL | …a/src/test/java/org/x402/server/PaymentFilterTest.java | 466 | org.junit.jupiter.api.Assertions.assertTrue(jsonString.contains("\"payer\":null"), | CODE |
| CRITICAL | …a/src/test/java/org/x402/server/PaymentFilterTest.java | 515 | org.junit.jupiter.api.Assertions.assertTrue(jsonString.contains("\"payer\":null"), | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | python/legacy/src/x402/svm_paywall_template.py | 2 | SVM_PAYWALL_TEMPLATE = '<!DOCTYPE html><html lang="en"><head>\n <meta charset="UTF-8">\n <meta name="viewp | CODE |
| HIGH⚡ | python/legacy/src/x402/svm_paywall_template.py | 2 | SVM_PAYWALL_TEMPLATE = '<!DOCTYPE html><html lang="en"><head>\n <meta charset="UTF-8">\n <meta name="viewp | CODE |
| HIGH⚡ | python/legacy/src/x402/svm_paywall_template.py | 2 | SVM_PAYWALL_TEMPLATE = '<!DOCTYPE html><html lang="en"><head>\n <meta charset="UTF-8">\n <meta name="viewp | CODE |
| HIGH | python/x402/mechanisms/evm/verify.py | 179 | Mirrors the on-chain keccak256(\\x19\\x01 || domainSeparator || hashStruct(message)) | STRING |
| HIGH | python/x402/mcp/utils.py | 149 | # as explicit nulls (e.g. resource.mimeType: null); strict facilitators — and proxies that | COMMENT |
| HIGH | examples/python/clients/batch-settlement/main.py | 9 | uv sync && uv run python main.py | STRING |
| HIGH | examples/python/facilitator/batch-settlement/main.py | 8 | uv sync && uv run uvicorn main:app --port 4022 | STRING |
| HIGH | examples/python/servers/batch-settlement/main.py | 10 | uv sync && uv run python main.py | STRING |
| HIGH | scripts/prepare-typescript-release.py | 561 | "pnpm is required to preview version bumps. Install pnpm and run: cd typescript && pnpm install" | CODE |
| HIGH | scripts/prepare-typescript-release.py | 840 | "pnpm is required to version packages. Install pnpm and run: cd typescript && pnpm install" | CODE |
| HIGH | scripts/prepare-go-release.py | 476 | "go is required to locate changie. Install Go and run: cd go && make deps-dev" | CODE |
| HIGH | scripts/prepare-go-release.py | 495 | "changie is required to build the changelog. Install it with: cd go && make deps-dev" | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/legacy/tests/fastapi_tests/test_middleware.py | 145 | CODE | |
| LOW | python/legacy/src/x402/flask/middleware.py | 147 | CODE | |
| LOW | python/legacy/src/x402/flask/middleware.py | 167 | CODE | |
| LOW | python/legacy/src/x402/clients/base.py | 86 | CODE | |
| LOW | python/x402/server.py | 179 | CODE | |
| LOW | python/x402/server.py | 247 | CODE | |
| LOW | python/x402/server.py | 499 | CODE | |
| LOW | python/x402/server.py | 567 | CODE | |
| LOW | python/x402/server_base.py | 551 | CODE | |
| LOW | python/x402/server_base.py | 1353 | CODE | |
| LOW | python/x402/server_base.py | 1574 | CODE | |
| LOW | python/x402/facilitator_base.py | 196 | CODE | |
| LOW | python/x402/facilitator_base.py | 377 | CODE | |
| LOW | python/x402/facilitator_base.py | 484 | CODE | |
| LOW | python/x402/client_base.py | 123 | CODE | |
| LOW | python/x402/client_base.py | 545 | CODE | |
| LOW | python/x402/mechanisms/svm/utils.py | 252 | CODE | |
| LOW | python/x402/mechanisms/evm/multicall.py | 180 | CODE | |
| LOW | python/x402/mechanisms/evm/eip712.py | 54 | CODE | |
| LOW | python/x402/mechanisms/evm/upto/permit2_utils.py | 374 | CODE | |
| LOW | python/x402/mechanisms/evm/upto/permit2_utils.py | 874 | CODE | |
| LOW | …ms/evm/batch_settlement/server/channel_manager_sync.py | 161 | CODE | |
| LOW | …ms/evm/batch_settlement/server/channel_manager_sync.py | 183 | CODE | |
| LOW | …x402/mechanisms/evm/batch_settlement/server/storage.py | 150 | CODE | |
| LOW | …hanisms/evm/batch_settlement/server/channel_manager.py | 191 | CODE | |
| LOW | …mechanisms/evm/batch_settlement/facilitator/deposit.py | 306 | CODE | |
| LOW | …/mechanisms/evm/batch_settlement/facilitator/refund.py | 142 | CODE | |
| LOW | python/x402/mechanisms/evm/exact/permit2_utils.py | 335 | CODE | |
| LOW | python/x402/mechanisms/evm/exact/permit2_utils.py | 762 | CODE | |
| LOW | python/x402/mechanisms/tvm/provider.py | 448 | CODE | |
| LOW | python/x402/mechanisms/tvm/provider.py | 533 | CODE | |
| LOW | python/x402/mechanisms/tvm/provider.py | 594 | CODE | |
| LOW | python/x402/mechanisms/tvm/provider.py | 597 | CODE | |
| LOW | python/x402/mechanisms/tvm/signers.py | 574 | CODE | |
| LOW | python/x402/mechanisms/tvm/streaming.py | 324 | CODE | |
| LOW | python/x402/mechanisms/tvm/streaming.py | 372 | CODE | |
| LOW | python/x402/mechanisms/tvm/exact/settlement_batcher.py | 110 | CODE | |
| LOW | python/x402/tests/conftest.py | 24 | CODE | |
| LOW | python/x402/mcp/server.py | 53 | CODE | |
| LOW | python/x402/mcp/server.py | 106 | CODE | |
| LOW | python/x402/mcp/server.py | 121 | CODE | |
| LOW | python/x402/mcp/utils.py | 217 | CODE | |
| LOW | python/x402/mcp/server_sync.py | 345 | CODE | |
| LOW | python/x402/mcp/server_async.py | 494 | CODE | |
| LOW | python/x402/extensions/sign_in_with_x/hooks.py | 100 | CODE | |
| LOW | python/x402/extensions/sign_in_with_x/hooks.py | 112 | CODE | |
| LOW | python/x402/extensions/builder_code/cbor.py | 266 | CODE | |
| LOW | python/x402/extensions/bazaar/server.py | 136 | CODE | |
| LOW | python/x402/extensions/bazaar/facilitator.py | 367 | CODE | |
| LOW | python/x402/extensions/bazaar/facilitator.py | 618 | CODE | |
| LOW | python/x402/http/x402_http_server.py | 84 | CODE | |
| LOW | python/x402/http/x402_http_server.py | 486 | CODE | |
| LOW | python/x402/http/x402_http_server_base.py | 188 | CODE | |
| LOW | python/x402/http/x402_http_server_base.py | 1105 | CODE | |
| LOW | python/x402/http/middleware/fastapi.py | 183 | CODE | |
| LOW | python/x402/http/middleware/fastapi.py | 259 | CODE | |
| LOW | python/x402/http/middleware/flask.py | 348 | CODE | |
| LOW | python/x402/http/middleware/__init__.py | 31 | CODE | |
| LOW | python/x402/http/middleware/_bazaar_utils.py | 44 | CODE | |
| LOW | examples/python/clients/mcp-chatbot/main.py | 128 | CODE | |
| 5 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/legacy/src/x402/flask/middleware.py | 292 | # Check if response is successful (2xx status code) | COMMENT |
| LOW | python/x402/server.py | 444 | # Check if verify/settle methods are coroutine functions (async) | COMMENT |
| LOW⚡ | python/x402/server_base.py | 579 | # Check if any facilitator supports this network/scheme via wildcard pattern | COMMENT |
| LOW⚡ | python/x402/server_base.py | 585 | # Check if the kind's network is a wildcard that matches | COMMENT |
| LOW | python/x402/server_base.py | 1436 | # Check if verification failed | COMMENT |
| LOW | python/x402/server_base.py | 1672 | # Check if settlement failed | COMMENT |
| LOW | python/x402/facilitator_base.py | 279 | # Check if network matches | COMMENT |
| LOW | python/x402/facilitator_base.py | 299 | # Check if network matches | COMMENT |
| LOW | python/x402/facilitator_base.py | 429 | # Check if verification failed | COMMENT |
| LOW | python/x402/facilitator_base.py | 536 | # Check if settlement failed | COMMENT |
| LOW | python/x402/mechanisms/svm/utils.py | 240 | # Check if this is a token program instruction | COMMENT |
| LOW | python/x402/mechanisms/svm/utils.py | 277 | # Check if this is a token program instruction | COMMENT |
| LOW | python/x402/mcp/client_async.py | 176 | # Check if this is a payment required response | COMMENT |
| LOW | python/x402/mcp/client_async.py | 216 | # Check if payment is approved | COMMENT |
| LOW | python/x402/mcp/utils.py | 398 | # Check if this is a 402 payment required error | COMMENT |
| LOW | python/x402/extensions/bazaar/v1/facilitator.py | 162 | # Check if outputSchema exists and has the expected structure | COMMENT |
| LOW | python/x402/extensions/bazaar/v1/facilitator.py | 168 | # Check if the endpoint is marked as discoverable | COMMENT |
| LOW⚡ | python/x402/http/x402_http_server.py | 405 | # Check if the result is a coroutine or future (async) | COMMENT |
| LOW | python/x402/http/x402_http_server.py | 644 | # Check if the result is a coroutine (async) - not supported | COMMENT |
| LOW | python/x402/http/x402_http_server_base.py | 196 | # Check if it's a single route config dict (has "accepts" key) | COMMENT |
| LOW | python/x402/http/clients/httpx.py | 127 | # Check if already a retry (via request extensions) | COMMENT |
| LOW | python/x402/http/clients/requests.py | 108 | # Check if this is already a retry (per-request state via header) | COMMENT |
| LOW | python/x402/http/middleware/fastapi.py | 280 | # Check if route requires payment (before initialization) | COMMENT |
| LOW | python/x402/http/middleware/flask.py | 377 | # Check if route requires payment | COMMENT |
| LOW | python/x402/http/middleware/flask.py | 488 | # Check if successful response | COMMENT |
| LOW | examples/python/facilitator/advanced/bazaar.py | 279 | # Check if this was an abort from hook | COMMENT |
| LOW | examples/python/facilitator/advanced/all_networks.py | 214 | # Check if this was an abort from hook | COMMENT |
| LOW | examples/python/facilitator/basic/main.py | 180 | # Check if this was an abort from hook | COMMENT |
| LOW | .github/workflows/publish_npm_scoped_x402_mcp.yml | 54 | # Check if version is a prerelease (contains -alpha, -beta, -rc, etc.) | COMMENT |
| LOW | e2e/legacy/clients/python/http/httpx/main.py | 27 | # Set timeout to 30 seconds to handle busy servers during test runs | COMMENT |
| LOW | e2e/facilitators/python/main.py | 424 | # Check if this was an abort from hook | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | python/legacy/src/x402/svm_paywall_template.py | 2 | SVM_PAYWALL_TEMPLATE = '<!DOCTYPE html><html lang="en"><head>\n <meta charset="UTF-8">\n <meta name="viewp | CODE |
| MEDIUM⚡ | python/legacy/src/x402/svm_paywall_template.py | 2 | SVM_PAYWALL_TEMPLATE = '<!DOCTYPE html><html lang="en"><head>\n <meta charset="UTF-8">\n <meta name="viewp | CODE |
| LOW | python/legacy/src/x402/clients/httpx.py | 25 | # If this is not a 402, just return the response | COMMENT |
| LOW | python/legacy/src/x402/clients/httpx.py | 29 | # If this is a retry response, just return it | COMMENT |
| MEDIUM⚡ | …sts/integrations/test_evm_batch_settlement_extended.py | 316 | # HTTP server harness (Flask + WSGI in a thread) | COMMENT |
| LOW⚡ | examples/python/servers/mcp/simple.py | 106 | # Paid tool - just call the bridge with args + context | COMMENT |
| MEDIUM | e2e/facilitators/python/main.py | 115 | # Network configuration — harness-injected `${ID}_NETWORK` or catalog testnet | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | python/legacy/src/x402/svm_paywall_template.py | 2 | SVM_PAYWALL_TEMPLATE = '<!DOCTYPE html><html lang="en"><head>\n <meta charset="UTF-8">\n <meta name="viewp | CODE |
| MEDIUM | …typescript/servers/advanced/custom-money-definition.ts | 43 | // NOTE: Wrapped XDAI is not an EIP-3009 complaint token, and would fail the current ExactEvm implementation. Th | COMMENT |
| MEDIUM | …ples/typescript/servers/offer-receipt/eip712-signer.ts | 13 | * This is a simple implementation for demonstration purposes. | COMMENT |
| MEDIUM | examples/typescript/servers/offer-receipt/jws-signer.ts | 13 | * This is a simple implementation for demonstration purposes. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 89 | Curated third-party SDKs, extensions, and facilitators are listed in the [Developer Tools docs](https://docs.x402.org/de | CODE |
| MEDIUM | specs/transports-v2/a2a.md | 304 | - [A2A x402 Extension Specification](https://github.com/google-agentic-commerce/a2a-x402/blob/main/spec/v0.1/spec.md) | CODE |
| MEDIUM | specs/transports-v1/a2a.md | 288 | - [A2A x402 Extension Specification](https://github.com/google-agentic-commerce/a2a-x402/blob/main/spec/v0.1/spec.md) | CODE |
| MEDIUM | docs/dev-tools/facilitators.md | 34 | | [Polygon Facilitator](https://docs.polygon.technology/payment-services/agentic-payments/x402/intro/) | Production-grad | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/legacy/src/x402/flask/middleware.py | 80 | CODE | |
| LOW | python/legacy/src/x402/clients/base.py | 36 | CODE | |
| LOW | python/legacy/src/x402/fastapi/middleware.py | 33 | CODE | |
| LOW | python/x402/tests/unit/mechanisms/evm/test_permit2.py | 47 | CODE | |
| LOW | …hon/x402/tests/unit/mechanisms/evm/test_facilitator.py | 189 | CODE | |
| LOW | …402/tests/unit/mechanisms/evm/test_upto_facilitator.py | 46 | CODE | |
| LOW | …402/tests/unit/mechanisms/evm/test_upto_facilitator.py | 132 | CODE | |
| LOW | python/x402/tests/unit/mechanisms/tvm/test_codec.py | 57 | CODE | |
| LOW | python/x402/tests/unit/mechanisms/tvm/fakes.py | 55 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .agents/skills/contributing/SKILL.md | 37 | Follow the repository AI-assisted contribution policy in [CONTRIBUTING.md](../../../CONTRIBUTING.md#ai-assisted-contribu | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | python/legacy/src/x402/svm_paywall_template.py | 2 | SVM_PAYWALL_TEMPLATE = '<!DOCTYPE html><html lang="en"><head>\n <meta charset="UTF-8">\n <meta name="viewp | CODE |
| LOW | …/concordium/test/integrations/exact-concordium.test.ts | 1273 | url: "https://example.com/premium-fake-token", | CODE |
| LOW | typescript/packages/extensions/src/bazaar/README.md | 113 | name: "John Doe", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | python/x402/tests/unit/http/clients/test_httpx.py | 172 | async def handle_request(request): | CODE |
| LOW | python/x402/tests/unit/http/clients/test_httpx.py | 234 | async def handle_request(req): | CODE |