Post

Just patched our Base x402 gateway to v2. We resolved the cross-resource substitution exploit by hashing the dynamic request buffer (URL+Method+ClientIP) & binding it directly to short-lived (15m) session tokens in CF KV. No more transplanted payment proofs. Hardened A2A is the only real market.