Security and vulnerability reporting

How to report

Email security@inkwell.finance with what you found, how to reproduce it, and its impact. The machine readable policy is at /.well-known/security.txt, and the checkout serves its own at https://pay.dagon.so/.well-known/security.txt. We do not run a bounty program and we do not pay rewards.

Look-alike sites, fake checkouts and people pretending to be us are not vulnerabilities, but please report them to abuse@inkwell.finance. Our real domains and addresses are listed at /official.

What happens next

We aim to acknowledge reports within 5 business days and to keep you informed of progress. We cannot promise a fix date or a reward. We ask for 90 days of coordinated disclosure before public details, and will agree a shorter or longer period for severe issues.

We prioritize vulnerabilities that are being exploited or that affect payments, wallets or keys, and we may pause checkout or wallet connection while we fix them. When an issue could have affected payments or user wallets, or requires you to act, we publish an advisory on this page.

In scope

Systems we operate at inference.dagon.so:

• The API under https://inference.dagon.so/v1 and the lease routes under /api. The /api management routes need a zkAPI management key you will not have; testing that they reject requests without it is in scope.
• The console at /app/ and this website.
• /webhooks/zoneless, which accepts signed calls from our checkout. You may test its signature checks with your own requests, but do not create or alter real payments.
• /admin, which needs an operator credential. Testing that it rejects unauthenticated requests is in scope; do not guess or brute force credentials.
• Billing logic: holds, charges, receipts and the signature scheme. Use only your own keys and funds.

And at pay.dagon.so:

• pay.dagon.so, our checkout, which we operate with Zoneless open source software. This covers its pages and the payment page routes (/v1/payment_pages/…, including the cross-chain prepare_cctp, confirm_cctp and cctp_payments routes). Use only your own wallet, your own key and the minimum top up. Do not attempt to change where a payment goes for anyone but yourself, to sign for or move our treasury, relayer or fee payer funds, or to call the cross-chain routes in bulk. If the bug is in the Zoneless code, also report it to its maintainers; we will coordinate.
• The public behavior of our cross-chain relayer, which receives USDC that Circle mints on Solana and forwards it to our treasury, as seen through your own payments.

On both:

• Vulnerabilities in third-party libraries we serve or run, including wallet connection libraries, when you show they are exploitable on our sites. Reports of a vulnerable version without that showing are welcome but treated as informational.

Out of scope

• Attacks on the infrastructure of abliteration.ai, Refuseless, Experiential Labs, Railway, Cloudflare, Circle, WaaP, WalletConnect or Reown, your wallet provider, or your own device. Report vulnerabilities in their code to them, and to us if they affect our pages. Look-alike or phishing sites are not vulnerabilities, but please report them to abuse@inkwell.finance. Do not build public look-alike pages, even to demonstrate an issue.
• Denial of service, volumetric testing, and flooding signup or key creation (rate limits exist).
• Spam, social engineering and physical attacks.
• Anyone else's keys or accounts, and funds beyond your own.
• Automated scanner output with no demonstrated impact.
• The model's content behavior. Refusals were removed by design, so "the model produced harmful content" or prompt injection of the model is not a vulnerability. Report model output issues to abliteration.ai.

Safe harbor

We consider security research that follows this policy to be authorized, and we will not initiate legal action against you or ask law enforcement to investigate you for it, provided you: stay within the scope above; make a good faith effort to avoid privacy violations, data destruction and service disruption; use only your own keys and funds; stop and report immediately if you reach another person's data and do not retain, copy or share it; give us reasonable time to fix an issue before disclosing it; and do not demand payment or threaten disclosure.

Testing the checkout. Authorized: using only your own wallet and your own key; real top ups at the minimum ($5), which are credited normally and not refunded; and reading and replaying your own checkout sessions. Not authorized: touching anyone else's checkout session; trying to redirect anyone else's payment or change its destination; attempting to move or sign for our treasury, relayer or fee payer funds; calling prepare_cctp or the relayer in bulk, which spends real network fees; standing up public look-alike or phishing pages, even as a demonstration (use localhost); and social engineering of users.

This policy covers only systems we operate. It does not bind third parties (abliteration.ai, Refuseless, Experiential Labs, Railway, Cloudflare, Circle, the maintainers of the Zoneless project, WaaP, WalletConnect or Reown, your wallet provider or blockchain networks), who may take their own action. If a third party starts legal action over research that followed this policy, we will make it known that you acted in compliance. We reserve all rights for activity outside this policy.

Vulnerable dependencies

We monitor published security advisories for the software the gateway, the console and the checkout depend on, including the wallet connection libraries their pages load. We triage by risk: vulnerabilities known to be exploited, and those in code that handles payments, wallets or keys, come first, and we may mitigate one by disabling a feature or pausing checkout before a fixed version exists. These are aims, not guarantees; we do not promise a fix time for any particular vulnerability.

Advisories

When a vulnerability or incident could have affected payments, wallets or keys, or requires you to act, we publish an advisory here. It gives the dates, the affected surface, what we checked and what you should do. No advisories have been published.

How the gateway protects you

• Key secrets are stored as hashes. A key is shown once.
• Every charge has an Ed25519 signed receipt that anyone can verify against the public key at /v1/identity.
• The console runs under a Content Security Policy that allows scripts only from this origin, blocks framing and sends no referrer. The scripts it serves include third-party wallet connection code (WaaP, and WalletConnect or Reown through it) bundled into the console, and when you open wallet login the console also connects to the wallet providers' hosts. The checkout at pay.dagon.so runs under the same kind of policy: scripts only from its own origin, each checked against a Subresource Integrity hash, no framing and no referrer. When you pay from another chain it loads the same wallet connection code and connects to those providers' hosts.
• Checkout starts only while our checkout reports our treasury wallet as the address it pays to; otherwise POST /v1/credits/checkout refuses.
• We never hold your wallet's keys.
• Holds stop two requests from spending the same balance.
• Prompts and outputs are not written to our database, so they cannot leak from it. They are still processed by the upstream provider that serves the request.
• Wallet vaults are encrypted in your browser before they reach us.

No system is perfectly secure; this list describes controls, not guarantees. See the privacy policy for what others can still see.