Security

If you find a security problem in BotsRated, please tell us privately so we can fix it before anyone else uses it.

How To Report

• Email: botsrated@gmail.com, with "Security" in the subject line.
• GitHub: private vulnerability report on the open-source repository.

Please tell us what is affected (a botsrated.com URL, an MCP tool, or a package name and version), how to reproduce it, and what an attacker could do with it. Please don't post it publicly until we have had a reasonable chance to fix it. If you want, we will credit you when we publish the fix.

What Is Covered

• This website and its API (/v1/...), the remote MCP server (/mcp) and the A2A endpoint (/a2a).
• Our signed receipts and signing keys (/.well-known/botsrated-key).
• The open-source client libraries and framework integrations on PyPI and npm, and the receipt format and verifier, all in github.com/botsrated/botsrated.

We especially want to hear about anything that could make a pre-payment check approve a payment it should block, make a paid call sign something other than the published price, forge a BotsRated signature, or make our checks or webhooks reach private networks.

Please Don't

• Run load or denial-of-service tests against this site.
• Access, change or delete data that isn't yours.
• Send payments or requests to other people's services on their behalf.

Not A Security Issue?

If a measurement about a seller or MCP server looks wrong, use the free disputes and corrections process instead. For anything else, write to botsrated@gmail.com.

Machine-readable: /.well-known/security.txt. Repository policy: SECURITY.md.