Notities
Notities
Metingen, tools en werknotities voor engineers die bouwen met AI-agents die betalen. Staat er een getal, dan staan de commando's die het opleverden in de tekst, zodat je het zelf kunt natrekken en het op de feiten met ons oneens kunt zijn.
De artikelen zelf staan in het Engels. Ze zijn geschreven voor mensen die tegen een specificatie aan bouwen die zelf Engels is, en een tweede versie zou betekenen dat elke correctie twee keer moet gebeuren.
Zoek je de langere stukken? Blog
Nieuwste
7 min lezen Measurements CRA
Eight security signals in 109 public repositories of organisations in ten EU countries
We ran our free check on 109 public repositories with a release. In 16 percent of them a security policy with a contact was visible, and in 4 percent an SBOM. What that says, and what it does not.
LezenEerdere notities
What x402 sellers that mention audits, security or smart contracts received in 90 days
We read the Bazaar index and measured what 343 sellers with audit or security routes received in 90 days. The median seller got 1.85 USDC. Our own numbers are next to it.
LezenTwo free tools found none of the known findings on the same contests
We ran Slither and Aderyn with default settings on the contests where our scan was measured. Neither matched a known High or Medium finding. What that says and what it does not.
LezenA standard x402 client can now buy the scan, and a quick scan costs 1 dollar
The scan endpoint could not be bought by a standard x402 client. That is fixed and checked with two real purchases. The official client also refuses payments above 1 dollar, so there is now a quick scan for exactly that.
LezenThe scan held its rate on nine newer contests
We ran the scan once on nine Code4rena contests from the last year. The first 15 hypotheses held 5 of 66 known findings, the same rate as before. What that says, and a second list in reports.
LezenThe scan signs its offer, and we paid it once to see the receipt
The paid scan endpoint now signs its x402 offer, binds the key to its domain in DNS, and returns a signed receipt. We tested it with one real payment of our own.
LezenThe scan now finds 8 of 105 on the same contests
A newer version of the scan is live. On the 8 contests of our sealed run it found 8 of 105 known findings, up from 4. What that means and what it does not.
LezenOfficial sources and payment addresses
Where our paid service lives and where its payments go, so a buyer or an agent can check an address before paying.
Lezen733,203 attestations were taken back
Counting revocations across the three largest EAS indexers to answer a fair objection: a signature does not make a statement true. Every one of them is an issuer withdrawing its own statement, and the counterparty has no move at all.
LezenA signed receipt that cannot name its own payment
It verifies, the key is authorized, and it cannot tell you which payment it is about. Tracing why, being corrected in public by someone who checked the chain, and the verifier another project changed the same day.
LezenI checked 600 live x402 services. None of them signs a receipt.
Six samples of a hundred across an index of 20,462 live resources, and the offer-receipt extension appeared in none of them. The method, the commands, the limits of the number, and a live endpoint that does sign one.
LezenNine ways to fake a delivery claim, and why none of them fully worked
A buyer signs a factual claim after an x402 payment. The obvious hole: what stops the buyer from lying? Nine independent designs, each built and broken against the real code.
LezenThe hierarchy of agent trust
Identity, authority, intent and delivery are four different questions. Most of the agent-economy stack answers the first three and stops.
Lezen