VerdictSwarm

// Legal

Security

The implemented boundaries around signed keys, paid calls, private-key custody, and gate failures.

Effective date
Effective · 2026-07-28
Version
Version · 1.0

In plain language

Signed API credentials are verified before they authorize a request.

x402 payment proof is verified and settled before paid scan work begins.

An unavailable dependency returns an error; integrations must treat that as a hold.

What this is not

Not a smart-contract security audit.

Not private-key custody; signing stays with the caller.

Not a substitute for your own credential hygiene and execution controls.

01

API keys

VerdictSwarm's signed vs1_ API keys contain a tier, key identifier, and HMAC-SHA256 signature. The API verifies that signature with its server-side signing secret and checks the revocation path before accepting signed-key access.

Keep API keys out of source control and client-side bundles. Replace a key if you believe it has been exposed.

02

Payments and custody

For x402 access, the service verifies a signed payment authorization or on-chain payment proof and settles the payment before paid scan work begins. Signing happens in the caller's wallet; VerdictSwarm does not ask for or take custody of the wallet's private key.

03

Failure behavior

Documented dependency failures return an error response instead of permission to continue. An upstream_data_unavailable failure is represented as HTTP 503 in the web integration contract.

04

Your responsibilities

A VerdictSwarm assessment is not a smart-contract audit and does not replace your own transaction simulation, allowlists, signing controls, rate limits, monitoring, or incident response.

05

Report a concern

Send suspected vulnerabilities or compromised-access concerns to support@sentienlabs.com with enough detail to reproduce the issue. Do not access another user's data, disrupt production, or use credentials that are not yours while testing.