Public index of merged good-faith security fixes from SashaMIT (Elacity).
Text-only credits. No logos, no “partner of,” no “we secured $TVL.”
Only landed (merged / publicly credited) work appears here.
| Date | Upstream | What changed | Proof |
|---|---|---|---|
| 2026-08-04 | x402-foundation/x402 | Plumb spend policies through MCP client factory so policy checks are not bypassed | PR #3034 (merged) · commit 08e84ab |
| 2026-08-04 | x402-foundation/x402 | Verify ERC-20 Transfer event after exact/eip3009 settlement (no silent false success) | PR #3032 (merged) · commit 3c63262 |
| 2026-08-04 | x402-foundation/x402 | Stop silent second charges on MCP corrective-402 recovery payments | PR #3033 (merged) · commit c427425 |