{"incidents":[{"broke":"Paid x402 evaluate could return 200 as if facilitator verify had succeeded. A forged header was enough.","closed_at":"2026-09-24T23:18:01+00:00","fix":"payment_verified() fail-closed. Header presence is never paid. Until facilitator verify is wired, every paid x402 call stays HTTP 402 — including non-empty X-Payment. Dev-only escape requires GATE_X402_ACCEPT_UNVERIFIED=1 AND GATE_DEV_MODE=1.","fix_pr":"https://github.com/jdnova0802/mishara/pull/103","found_by":"SCVD weekly crawl + internal red-team","found_how":"A crawler (and then a red-team pass) posted Payment-Signature: not-a-real-payment to POST /v1/prefinality/evaluate. Presence of the header unlocked the paid route.","id":"2026-09-24-x402-header-paid","opened_at":"2026-09-24T20:00:00+00:00","severity":"high","status":"closed","still_open":"CDP facilitator verify+settle is wired in payment_verified(); unlock still needs CDP_API_KEY_ID/SECRET on Render and one real $0.002 USDC buyer settle on POST /v1/prefinality/evaluate. Forged headers must keep returning 402.","title":"x402 treated a payment header as paid","verify_live":"curl POST /v1/prefinality/evaluate with Payment-Signature: not-a-real-payment must return HTTP 402."},{"broke":"Spend-map invariant 'one job_id, one spend' was not serialized.","closed_at":"2026-09-24T23:18:01+00:00","fix":"consume_bind_ticket opens BEGIN IMMEDIATE, then rejects a second consumed ticket for the same job_id with reason job_already_spent.","fix_pr":"https://github.com/jdnova0802/mishara/pull/103","found_by":"internal red-team","found_how":"Concurrent redeem of two bind tickets for one job_id could both pass before consumed_at was visible to the other writer.","id":"2026-09-24-spend-map-race","opened_at":"2026-09-24T20:00:00+00:00","severity":"high","status":"closed","still_open":"Automated sqlite backup of /var/data/gate.db is still not shipped.","title":"Two tickets could spend the same job_id","verify_live":"Second consume of the same job_id returns job_already_spent."}],"page":"https://gate.velaru.xyz/record","spec":"gate-incidents-v1"}