Security & disclosure
Tape is a read-only analytics terminal. This page is the vulnerability-disclosure policy referenced by /.well-known/security.txt (RFC 9116). Report security issues to security@tapeperp.com — not on public socials, and not as a paid x402 call.
1. What Tape holds — and what it never holds
- Never holds keys, seed phrases, or funds. Tape cannot place trades, approve builders, or withdraw. Wallet addresses you look up are public on-chain identifiers.
- Account tokens and API keys are the only credentials Tape issues. They live in HttpOnly
Securecookies (__Host-tape_acct) and in TAPE_KV. Tape will never ask for them by email or Telegram DM. - Payments settle as USDC on Base via x402 / EIP-3009 to a published receive address. Tape does not run a hot wallet on this Worker.
2. How to report
Email security@tapeperp.com with: the affected URL or endpoint, a short reproduction, impact, and (if you have one) a transaction hash. We acknowledge reports we can act on, usually within a few business days. Do not include customer tokens, API keys, or unrelated personal data.
3. Scope
- In scope: tapeperp.com and www.tapeperp.com Worker responses,
/api/*,/mcp, x402 settlement handling, session cookies, and admin-gated operators. - Out of scope: Hyperliquid L1 itself, third-party wallets, Telegram, Google Analytics, and reports that require us to hold or move user funds — we cannot.
- Please do not run destructive load tests, social-engineer support, or probe customer accounts.
4. What we already lock down
- HSTS (2 years, includeSubDomains, preload-ready), CSP with
frame-ancestors 'none', CORP same-origin on HTML, COOP same-origin, Permissions-Policy denying camera/mic/geo/topics. - Admin and liquidation API keys compared with SHA-256 +
timingSafeEqual. Unauthenticated/api/debugis a bare health check — no token-length leak. - Free
/api/*is rate-limited per IP (Workers Rate Limiting + isolate fallback). Paid surfaces require x402 settlement or an active key. - Public HTML pages cache at the edge, keyed on deploy version, and every HIT is re-wrapped with the live header pack.
5. Safe harbor
Good-faith research that stays in scope, avoids privacy harm, and reports to security@tapeperp.com will not be treated as an attack. We do not run a paid bug bounty today; we will credit researchers who want to be named.
Questions that are not security reports: support@tapeperp.com.