Purchase-path audit

$50 USDC, upfront · delivered by a person, not by an endpoint · audits delivered: 0

One paid endpoint of yours, investigated until the reason a buyer cannot complete a purchase is named with evidence — then re-checked after you have fixed it.

Who this is for

An operator with outside buyers and a discovery, integration or payment-support problem on one paid endpoint. Your endpoint answers a 402, someone is meant to be paying it, and either they are not arriving or they arrive and something between them and the money does not work.

Not for anyone who just wants a grade. A grade is free and takes one request: GET /check returns the whole check catalogue, and Start here shows how to read a report before paying for anything. The automated checks against your live 402 cost $0.10 per report — POST /lint, on the price sheet. If a free probe and an automated report already tell you everything you need, buy neither of the paid things. That is an honest outcome and it is the common one.

What $50 buys — the whole boundary

1. One paid endpoint, its discovery chain, and two agreed client environments.
2. Actual-client reproduction, with minimal failing and passing requests and captured evidence.
3. A configuration diagnosis and proposed remediation, distinguishing confirmed causes from hypotheses; no production changes.
4. One budget-capped paid canary after remediation, with a short verification report.
5. One follow-up retest within seven days; implementation, additional endpoints, and later releases excluded.

Excluded, explicitly: implementation, additional endpoints, and later releases. Nothing in your production configuration is changed by us; the remediation is proposed and you apply it. Delivery is capped at two hours. If the problem turns out to be larger than two hours of investigation, you are told that instead of being billed for more.

Price and payment

$50 USDC, upfront, on Base — paid to the same receiving address this service's own 402 responses advertise:

0x885E7BEF433eb78F5976b28A7c10739c98DB11E5

That address is read from the live service, not typed into this page, so it cannot drift from the one in a 402 envelope. Verify it yourself before sending anything: any unpaid call to a paid route quotes it (POST /lint answers 402 with the full envelope, and the payTo in that envelope is the authority).

This is not an x402 route. There is no 402 to pay here, no automated settlement, and it is never published as a discoverable resource: the default spending ceiling in the common x402 client is $0.10, so a $50 quote would simply be refused by every client running the default. This is a human purchase, and it is priced and delivered as one.

Include a reference so the payment can be matched to you: put AUDIT <your-endpoint-host> in the subject line of your email, and the transaction hash in the body.

How to start

Email support@10x402.com with three things:

• the paid endpoint (one URL);
• the two client environments you want it reproduced against;
• the transaction hash of the $50 payment.

You get a reply within two business days: either the audit, or a refund if the house cannot deliver it.

Worked example: the house's own purchase path

This is what the report looks like, written from the one incident the house has first-hand evidence for — its own. Every number below is dated and was measured, not recalled.

Reproduction

Found 2026-09-02 during a listing sweep. GET /llms.txt on 10x402.com answered 403 with the body error code: 1010 to User-Agent: Python-urllib/3.14 — the Python standard library's default. The same path answered 200 to curl. The same pair reproduced on three house hosts: 10x402.com, the toolshed site, and lemon-agent.dev.

Measured again 2026-09-03, about 02:1x UTC: GET /llms.txt and GET /openapi.json both 403 error code: 1010 for Python-urllib/3.14, while the paid route POST /lint answered 402 to the same user-agent. A buyer on the Python standard library could pay and could not read what it was paying for.

Diagnosis

Confirmed. Cloudflare Pages applies its own Browser Integrity Check to everything the Pages project serves. The zone's Browser Integrity Check was turned off and a zone WAF Skip rule was added; both were verified ineffective, and the pages.dev hostname answered 403 to the same user-agent while curl got 200. On 2026-09-03, about 14:45 UTC, a Pages Function (functions/[[path]].js forwarding to env.ASSETS) was deployed on a sibling host to test whether dynamic code escaped the check: still 403 error code: 1010 on both the custom domain and the fresh pages.dev deployment. Functions sit behind the same check.

Hypothesis, and labelled as one at the time. That no zone-level control we could reach would move it, and that only a path owned by a Worker attached to the zone would bypass it. The two zone-level controls available had already failed; the Worker route had not yet been tried, so this was the next thing to test rather than a conclusion.

Remediation

Every machine surface — /llms.txt, /openapi.json, /.well-known/x402, /skill.md, /sitemap.xml, /robots.txt — was baked into a build-generated module and served from the zone Worker, with one route pattern per path. Shipped 2026-09-03.

Verification

Post-deploy, on 2026-09-03, a scripted probe re-ran the same requests: all six surfaces answered 200 for Python-urllib/3.14, python-requests/2.32, curl/8, node, and a request sending no User-Agent header at all; the paid routes answered 402 to the same identities. Exposure window: 2026-08-20 (launch) to 2026-09-03 — about two weeks.

What this example does not contain. Step 4 of the boundary is a budget-capped paid canary after the fix. This incident has no first-hand example of one: the house had no third-party buyer to run a canary with, and a canary that did not happen is not going to be written up as though it did. In a paid engagement that step is a real purchase against your fixed endpoint, with the receipt in the verification report.

The defect class from this incident is now a check anyone can run for free against their own host: UA_GATE_SURFACES in the published catalogue. The wording rule the report follows is worth stealing: the finding says a host answers 403 to user-agent Python-urllib/3.14. It never says the host "blocks Python" — a user-agent string is a header, not a runtime, and a report that confuses the two is a report that gets argued with instead of acted on.

After the audit

You can ask for one retest reminder, free — one email from you, one reminder from us on the date you name, and then your address is deleted.

Disclosure

The house sells its own x402 endpoints and the automated lint, so read this the way you would read any seller's own report. Findings are given away free, with their reproduction, whether or not anyone buys anything; the paid part is the diagnosis of your particular failure and the verification that your remediation worked. Ratings, grades and the lint's verdict are computed from the published catalogue and are never affected by whether you bought an audit — there is no input to that computation that knows.

Audits delivered: 0. That number is maintained by hand and will keep saying zero until it is not zero.