1 min read Official
Official sources and payment addresses
Where our paid service lives and where its payments go, so a buyer or an agent can check an address before paying.
Earlier this month a third party listed our project with a different payment address. The listing request was withdrawn after we pointed it out. This page exists so that nobody has to take our word, or anyone else's, for where the money goes.
Bug Bounty Intelligence
- Repository: holistis/bug-bounty-intelligence-mcp
- Payment request:
https://x402.tokenizen.nl/api/bug-intel - Price: 5 USDC per scan, on Base (eip155:8453), through x402
- Payment address:
0x015Eb036560216B3051339061FF68A207E0fe88f
Check it yourself
The endpoint states its own payment address. This prints it, and you compare it with the line above and with the README of the repository:
npx -y agent-receipt-verify https://x402.tokenizen.nl/api/bug-intel
If a listing, a reply or a website gives another address for Bug Bounty Intelligence, it is not ours. Do not pay it.
What this list is not
It covers only the service named above. It does not vouch for any other address, and it changes only through a pull request in the open repository, so its history is public.
It also says nothing about how good the scan is. The scan returns AI-generated hypotheses to review by hand. In a pre-registered test on 8 sealed audit contests the version in production found 1 of 105 known High and Medium findings, and a newer version, not in production, found 4. The results, with the misses, are in the repository.