API keys
VerdictSwarm's signed vs1_ API keys contain a tier, key identifier, and HMAC-SHA256 signature. The API verifies that signature with its server-side signing secret and checks the revocation path before accepting signed-key access.
Keep API keys out of source control and client-side bundles. Replace a key if you believe it has been exposed.
Payments and custody
For x402 access, the service verifies a signed payment authorization or on-chain payment proof and settles the payment before paid scan work begins. Signing happens in the caller's wallet; VerdictSwarm does not ask for or take custody of the wallet's private key.
Failure behavior
Documented dependency failures return an error response instead of permission to continue. An upstream_data_unavailable failure is represented as HTTP 503 in the web integration contract.
Your responsibilities
A VerdictSwarm assessment is not a smart-contract audit and does not replace your own transaction simulation, allowlists, signing controls, rate limits, monitoring, or incident response.
Report a concern
Send suspected vulnerabilities or compromised-access concerns to support@sentienlabs.com with enough detail to reproduce the issue. Do not access another user's data, disrupt production, or use credentials that are not yours while testing.