Protect the keys, the bytes, and the boundary.
Security expectations for people, agents, sellers, and deployment operators using 0xRouter.
What we protect
- Private source ZIPs and preview storage boundaries.
- Session, API-key, and seller authorization boundaries.
- Payment identity, receipt, and settlement references without returning raw proofs.
- Contract and network configuration as deployment-controlled runtime values.
What never belongs in a request
Never submit a seed phrase, private key, API secret, facilitator secret, database credential, or raw signed payment payload to a support form, prompt, URL, product description, or public issue.
How to report a concern
Use the deployment's documented support or security contact and include a concise description, affected public route, reproduction steps, timestamps, and safe references. Do not include personal data, private content, or working exploit payloads unless the agreed security channel specifically requests them.
Operational caveat
Security controls are release-gated. Local Phase 01 behavior, testnet behavior, and production guarantees are not interchangeable; verify the deployment's environment and network before trusting an action.