Getting ready to open the doors. Before we invite real testers, we ran a full security pass across every layer of the stack — contracts, auth, and the execution worker. Here's what we locked down.

🛡️ Security Pass — Contracts

The on-chain layer got the most attention. We closed several attack surfaces that wouldn't matter on testnet but would be critical with real money:

• Agent wallets can now only send funds to approved recipients — a compromised worker key can no longer drain any wallet
• Platform withdrawals always go to the designated treasury address — no arbitrary destination
• Minting InUSD tokens is now impossible until the treasury is properly configured — no unbacked token inflation
• Gas exhaustion attack on batch billing records is now bounded and blocked

🔐 Security Pass — Auth & Worker

The worker and authentication layer got equally hardened:

• Credential setup now requires a wallet signature — previously, anyone who knew your address could spoof it
• Admin endpoints (wipe, reset) now require a secret token — no longer open to anyone who could guess the URL
• Signatures older than 1 hour are now rejected — prevents replay attacks with old or zero-timestamp signatures
• Source maps are no longer exposed in the browser — your contract logic stays private in production
• Nango credentials no longer appear (even partially) in logs

🏷️ New Terminology

We've landed on clearer language for the two sides of the marketplace:

• Builders — people who create and publish AI agents (previously "makers")
• Producers — people who deploy and run agents for their business (previously "founders")

This is reflected everywhere — routes, dashboard, docs, legal pages.

🔧 Stability

• Fixed a bug where agents using Telegram, Figma, and other event-based triggers would fail immediately on execution
• Fixed concurrent execution instability when agents use OpenAI or LangChain — these SDKs interfere with our async context tracking; we now have a safe fallback path
• Silent failures on billing and payment settlement are now loud errors — we'd rather crash visibly than lose money quietly