How to report. Email security@code402.dev with details, reproduction steps, and impact. Please do not test against live payment flows beyond a minimal proof.
Response. We aim to acknowledge reports within 5 business days. This is a target, not a contractual commitment.
Scope. The machine surface (https://hcrb.in) and this site. Reports about third-party infrastructure (Cloudflare, Base, Circle) will be redirected to those parties.
Policy. security.txt on the machine surface is the canonical pointer to this page.