Treat it as financial software. We do.

Implemented controls

• Non-custodial by construction
  The runtime holds no keys and no balances; there is deliberately no field in the data model for a private key or a custodial balance. Delivery is only to destinations the customer controls.
• Server-side authorization
  Every request to a gated surface is authorized on the server against a verified identity or key; the client is never the source of truth for who may move what.
• Idempotent side effects
  Every money-moving step carries a deterministic idempotency key. Retries, reroutes, and self-heal can never double-execute.
• Partner authentication
  Rail authentication uses challenge signing with dual signatures — the customer key plus the loadit.net domain key — verified against partner requirements.
• Secrets
  Signing keys and access secrets are server-only environment variables; none ship to clients or live in the repository. Access codes are compared timing-safe.
• Transport
  HTTPS everywhere, HSTS preloaded, nosniff and frame protections on every response.
• Verifiable routing receipts
  Routing receipts are published with signatures third parties can verify; tampered receipts fail verification.

Planned

Report a vulnerability

Email colt@loadit.net with details and steps to reproduce. We acknowledge reports and do not pursue good-faith researchers.