Security and trust

What is protected today, how it was checked, and what is still open.

Checked in tests

Sign-in: single-use nonce, replay and foreign-key signatures rejected; the app signs only the exact five-line message.
Keys: shown once, spend caps enforced, only the owner can revoke.
Billing: unpriced models are refused before any seller is called and cost nothing.
x402 and top-up: underpayment, wrong reference, wrong payee, wrong token, reuse and simultaneous double-spend are all rejected.
One transfer can be spent once, across top-up and x402 together.

heura never holds your wallet keys. Sign-in signs a message only.
x402 is non-custodial: you broadcast the payment, the server only reads the receipt.
The balance you top up is an account balance, not a withdrawable asset.

Read this before putting value at risk

Nothing has been audited, including the gateway and the payment checks.
heura is not launched. Tests ran on a fork of the chain and on mainnet with heura's own wallets and a few dollars of USDG. No customer funds have moved.
Staking was removed and will not return until a Solidity version is written and audited.
Seller payouts, when enabled, are sent from a capped hot wallet, so only a small amount sits there at a time.
Prompts and replies pass through the seller that serves you. Do not send secrets you would not send to that provider.
There is no seller verification yet, so seller quality is unmeasured.

Security contact details will be published at launch.