Security
If you find a security problem in BotsRated, please tell us privately so we can fix it before anyone else uses it.
How To Report
- Email: botsrated@gmail.com, with "Security" in the subject line.
- GitHub: private vulnerability report on the open-source repository.
Please tell us what is affected (a botsrated.com URL, an MCP tool, or a package name and version), how to reproduce it, and what an attacker could do with it. Please don't post it publicly until we have had a reasonable chance to fix it. If you want, we will credit you when we publish the fix.
What Is Covered
- This website and its API (
/v1/...), the remote MCP server (/mcp) and the A2A endpoint (/a2a). - Our signed receipts and signing keys (/.well-known/botsrated-key).
- The open-source client libraries and framework integrations on PyPI and npm, and the receipt format and verifier, all in github.com/botsrated/botsrated.
We especially want to hear about anything that could make a pre-payment check approve a payment it should block, make a paid call sign something other than the published price, forge a BotsRated signature, or make our checks or webhooks reach private networks.
Weaknesses We Find In Services We Check
Some checks can show a security weakness in a service we test, for example a service serving a request again for a payment that was already used (what our Resent Payment Check would look for; it is not currently running and would only ever run on sellers who opt in). We report such a weakness privately to the service. We never publish it under the service's name until at least 90 days after we have reached them, and never if we can't reach them; then we publish, at most, anonymous totals. See methodology.
Please Don't
- Run load or denial-of-service tests against this site.
- Access, change or delete data that isn't yours.
- Send payments or requests to other people's services on their behalf.
Not A Security Issue?
If a measurement about a seller or MCP server looks wrong, use the free disputes and corrections process instead. For anything else, write to botsrated@gmail.com.
Machine-readable: /.well-known/security.txt. Repository policy: SECURITY.md.