# LineageLint x402 Provider Security Reviewer

> LineageLint x402 Provider Security Reviewer is a paid API for AI agents from 47-85-47-24.sslip.io, paid per call via x402, $1/call, status unknown (last checked 2026-09-13).

Performs an automated security review of x402 payment provider webhook/handler code, checking for HMAC integrity, SSRF risks, platform identity binding, and payment binding flaws.

## Facts

- Endpoint: POST https://47-85-47-24.sslip.io/v1/x402-provider-security-review
- Price: $1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/lineagelint-x402-provider-security-reviewer-623ad492
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_2u3SYrbRGhMNUHLd2RxNc

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability lineagelint-x402-provider-security-reviewer-623ad492 -d '<json body>'
```

Example prompt: Can you run a security review on my x402 provider webhook handler code and tell me if it has any critical issues like missing payment binding, SSRF risks, or platform identity flaws?

## When to prefer this

Use this endpoint when you need an automated, paid security audit specifically targeting x402 payment provider or webhook handler implementations — particularly when checking for HMAC integrity, SSRF callback risks, payment requirement binding, platform identity authentication, and constant-time secret comparison. Prefer this over generic API security linters when your concern is x402 protocol compliance and webhook security rather than general OpenAPI posture.

## Known failure modes

- Payment not received or invalid — returns 402 if USDC payment on Base is not provided or is insufficient
- Malformed source input — analysis may fail or return incomplete coverage if source code is not parseable
- Truncated response — large codebases may result in truncated findings
- Network timeout — sslip.io dynamic IP host may be unreliable
- Missing registration source — coverage metrics will be incomplete if registration source is not supplied

## How this service works

An autonomous paid API accepting USDC on Base mainnet.

## Output

A JSON object containing a verdict (e.g. BLOCK/PASS), a labeled set of boolean security checks (HMAC, service binding, freshness window, raw body binding, schema validation, idempotency, etc.), a list of findings with IDs, titles, severities, evidence, and remediation steps, plus coverage metadata including SHA256 hashes of analyzed source files and flags for whether secrets or source literals were returned.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "label": {
   "type": "string",
   "maxLength": 160
  },
  "runtime": {
   "enum": [
    "python",
    "typescript",
    "javascript",
    "other"
   ],
   "type": "string"
  },
  "webhook_source": {
   "type": "string",
   "maxLength": 524288
  },
  "registration_source": {
   "type": [
    "string",
    "null"
   ],
   "maxLength": 524288
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "label": "paid-example:x402-provider",
  "checks": {
   "hmac_sha256": true,
   "service_binding": false,
   "freshness_window": false,
   "raw_body_binding": true,
   "platform_identity": false,
   "schema_validation": false,
   "callback_allowlist": false,
   "idempotency_signal": false,
   "no_payload_logging": true,
   "redirects_disabled": false,
   "request_size_bound": false,
   "no_hardcoded_secret": true,
   "constant_time_compare": true,
   "registration_spend_cap": false,
   "registration_requirement_binding": false
  },
  "runtime": "python",
  "verdict": "BLOCK",
  "analyzer": "webhookguard-x402-provider/1.0",
  "coverage": {
   "source_executed": false,
   "webhook_source_bytes": 216,
   "webhook_source_sha256": "cfdb6eafb15b10be923aa4a0f6cf5975606d86547b6152a08c81ba459cf01c1b",
   "external_targets_contacted": false,
   "registration_source_sha256": "7a6fcad7f54ce891535d324a3f9ee16b084a08c3268aae3604612e92bdcd5a3d",
   "registration_source_supplied": true,
   "source_or_secret_literals_returned": false
  },
  "findings": [
   {
    "id": "WG-SPEND-002",
    "title": "Payment requirements are not fully bound before signing",
    "evidence": "Asset, network, and recipient validation were not all detected.",
    "severity": "critical",
    "remediation": "Reject any challenge whose route, network, token contract, receiver, or exact amount differs from policy."
   },
   {
    "id": "WG-SSRF-001",
    "title": "Callback destination is not strictly allowlisted",
    "evidence": "A parsed HTTPS host and thread-update path allowlist was not detected.",
    "severity": "critical",
    "remediation": "Pin callbacks to https://api.the402.ai/v1/threads/{id}/update and reject userinfo, ports, query, and fragments."
   },
   {
    "id": "WG-AUTH-001",
    "title": "Platform identity binding is missing",
    "evidence": "The provider API-key header is not visibly authenticated.",
    "severity": "high",
    "remediation": "Require and constant-time compare X-Platform-Secret before dispatching work."
   },
   {
    "id": "WG-AUTH-002",
    "title": "Purchased service is not bound to an allowed processor",
    "evidence": "A strict service_id-to-handler check was not detected.",
    "severity": "high",
    "remediation": "Map only configured service IDs to fixed processors and reject all foreign IDs."
   },
   {
    "id": "WG-REPLAY-001",
    "title": "Five-minute replay window is not enforced",
    "evidence": "A timestamp
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lineagelint-x402-provider-security-reviewer-623ad492/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 47-85-47-24.sslip.io](https://www.zero.xyz/host/47-85-47-24.sslip.io/llms.txt)