Service safeguards

Security

Prospect402 deliberately limits what it will fetch and return. These controls reduce risk; they are not permission to test or scan third-party websites without authorization.

Request boundaries

• Only absolute public HTTPS URLs are accepted.
• Local, private, reserved, credential-bearing, and custom-port targets are rejected.
• Redirects remain on the submitted origin.
• Robots rules are respected.
• A crawl reads no more than four HTML pages, with strict time and response-size limits.
• Website JavaScript is not executed.

Payment and data

The Worker needs only a public receiving address—never a wallet private key or recovery phrase. Failed request handlers return non-2xx responses so x402 middleware does not settle them. Reports and successful-payment retry records may be cached for 24 hours.

Reporting

Report vulnerabilities privately through the operator contact published with the production service. Do not include wallet secrets or personal data, and do not test against third-party websites without authorization.