Security & disclosure

Tape is a read-only analytics terminal. This page is the vulnerability-disclosure policy referenced by /.well-known/security.txt (RFC 9116). Report security issues to security@tapeperp.com — not on public socials, and not as a paid x402 call.

1. What Tape holds — and what it never holds

• Never holds keys, seed phrases, or funds. Tape cannot place trades, approve builders, or withdraw. Wallet addresses you look up are public on-chain identifiers.
• Account tokens and API keys are the only credentials Tape issues. They live in HttpOnly Secure cookies (__Host-tape_acct) and in TAPE_KV. Tape will never ask for them by email or Telegram DM.
• Payments settle as USDC on Base via x402 / EIP-3009 to a published receive address. Tape does not run a hot wallet on this Worker.

2. How to report

Email security@tapeperp.com with: the affected URL or endpoint, a short reproduction, impact, and (if you have one) a transaction hash. We acknowledge reports we can act on, usually within a few business days. Do not include customer tokens, API keys, or unrelated personal data.

3. Scope

• In scope: tapeperp.com and www.tapeperp.com Worker responses, /api/*, /mcp, x402 settlement handling, session cookies, and admin-gated operators.
• Out of scope: Hyperliquid L1 itself, third-party wallets, Telegram, Google Analytics, and reports that require us to hold or move user funds — we cannot.
• Please do not run destructive load tests, social-engineer support, or probe customer accounts.

4. What we already lock down

• HSTS (2 years, includeSubDomains, preload-ready), CSP with frame-ancestors 'none', CORP same-origin on HTML, COOP same-origin, Permissions-Policy denying camera/mic/geo/topics.
• Admin and liquidation API keys compared with SHA-256 + timingSafeEqual. Unauthenticated /api/debug is a bare health check — no token-length leak.
• Free /api/* is rate-limited per IP (Workers Rate Limiting + isolate fallback). Paid surfaces require x402 settlement or an active key.
• Public HTML pages cache at the edge, keyed on deploy version, and every HIT is re-wrapped with the live header pack.

5. Safe harbor

Good-faith research that stays in scope, avoids privacy harm, and reports to security@tapeperp.com will not be treated as an attack. We do not run a paid bug bounty today; we will credit researchers who want to be named.

Questions that are not security reports: support@tapeperp.com.

For educational purposes only. Not trading advice. Not investment advice. Tapeperp is independent and not affiliated with, endorsed by, or sponsored by Hyperliquid. Independent. Not affiliated with Hyperliquid Labs or the Hyperliquid Foundation. Tape is analytics-only and non-custodial. Nothing here is financial advice. Report vulnerabilities to security@tapeperp.com. Last updated 2026-11-06 09:20:22 UTC