Security Model
The security controls actually implemented.
VerseBill layers several concrete mechanisms to reduce fraud and payment mistakes. It is not, and does not claim to be, fraud-proof.
- Authentication via verified Privy access tokens
- Authorization checks that a merchant owns the resource
- Zod input validation on every state-changing route
- In-memory rate limiting on sensitive endpoints
- Idempotency for payment submissions (unique chain ID + tx hash)
- Server-side on-chain verification before marking paid
- Strict Content-Security-Policy and security headers
- Server-side secrets; never exposed to the browser