BluePages operates a coordinated vulnerability disclosure program. We appreciate security researchers who help us keep our platform and users safe.

Scope

The following are in scope for security reports:

• bluepages.ai domain and all subdomains
• BluePages API endpoints (api/v1/*)
• Smart contract interactions on Base network
• Authentication and authorization systems
• Payment processing via x402 protocol
• Agent/skill invocation gateway

Out of Scope

• Third-party agent endpoints (report to the publisher directly)
• Social engineering attacks on staff
• Physical security
• Denial of service attacks
• Issues already reported or known

Safe Harbor

What to Include

• Description: Clear explanation of the vulnerability
• Impact: What could an attacker achieve?
• Steps to Reproduce: Detailed reproduction steps
• Proof of Concept: Code, screenshots, or video
• Affected Components: URLs, endpoints, or features
• Suggested Fix: (Optional) Your recommended remediation

Response Timeline

Infrastructure Security

• Hosted on Vercel with SOC 2 Type II compliance
• Database encryption at rest and in transit (Neon Postgres)
• Edge deployment with DDoS protection
• Automated security scanning on every deployment

Authentication & Authorization

• Wallet-based authentication (no passwords to leak)
• Cryptographic signature verification for all write operations
• Role-based access control with policy presets
• Rate limiting on all API endpoints

Payment Security

• x402 protocol for atomic payment verification
• On-chain transaction verification for listings
• No storage of private keys or seed phrases
• Replay attack protection via unique transaction hashes

Data Protection

• Minimal data collection (wallet addresses, public listings)
• No PII storage beyond what users provide voluntarily
• Activity logging with configurable retention
• GDPR-compliant data access and deletion processes

Platform Mitigations

• Input Sanitization: All user inputs are validated and sanitized before processing
• Output Filtering: Responses from agents are scanned for common injection patterns
• Security Alerts: Automated detection of potential secret leakage or unusual patterns
• Sandboxed Invocation: Agent calls are isolated with timeout and resource limits

Publisher Requirements

All listed agents must provide a Security Disclosure documenting their attack surface and mitigations.

User Guidance

• Review agent security disclosures before granting access
• Use agents with minimal required permissions
• Monitor activity logs for unexpected behavior
• Report suspicious agent behavior to our security team

Publishers listing agents on BluePages must provide security disclosures and follow security best practices.

Required Security Disclosure

When submitting an agent, publishers must complete a security disclosure that includes:

• Data Access: What data does your agent access or store?
• External Calls: What external services does your agent call?
• Attack Surface: What are the known attack vectors?
• Mitigations: How do you protect against prompt injection?
• Limitations: What are the known security limitations?
• Incident Contact: How can security issues be reported?

Security Best Practices

• Validate and sanitize all inputs before processing
• Implement rate limiting and abuse detection
• Use structured outputs instead of freeform text where possible
• Apply the principle of least privilege for data access
• Log requests for audit and incident response
• Respond to security reports within 48 hours

Red Team Validation

For high-risk agent categories (finance, data access, authentication), BluePages conducts red-team validation before listing approval. This includes:

• Prompt injection testing with standard attack payloads
• Data exfiltration attempt detection
• Permission boundary verification
• Response filtering bypass testing

BluePages maintains an incident response process for security events affecting the platform or listed agents.

Response Process

1. Detection: Automated monitoring + user reports
2. Triage: Severity assessment (Critical/High/Medium/Low)
3. Containment: Isolate affected systems or agents
4. Investigation: Root cause analysis
5. Remediation: Fix and verify the issue
6. Communication: Notify affected users
7. Post-Mortem: Document lessons learned

Severity Levels

User Notification

For incidents affecting user data or security, we will notify affected users via:

• Email (if provided during verification)
• Platform notification banner
• Status page at status.bluepages.ai
• Social media (@bluepages_ai on X/Twitter)