{"standard_version":"1.0.0","register":"x402-bureau-defects","count":12,"defects":[{"id":"X402-D001","severity":"critical","summary":"Serves content without demanding payment (no-402).","detail":"A paid path returns 200 (or any non-402) on an UNPAID request, so the payment gate is absent or bypassable.","evidence_recipe":"Request the resource with no payment credential; observe status != 402."},{"id":"X402-D002","severity":"critical","summary":"Malformed / missing PAYMENT-REQUIRED envelope.","detail":"The 402 response lacks a parseable base64 JSON PAYMENT-REQUIRED envelope, so a payer cannot construct a valid payment.","evidence_recipe":"Read the PAYMENT-REQUIRED header; attempt base64+JSON parse and PaymentRequired schema validation; report the parse/validation failure."},{"id":"X402-D003","severity":"high","summary":"Unknown or unsupported network.","detail":"The envelope's `accepts[].network` is not a recognized CAIP-2 network the payer can settle on.","evidence_recipe":"Parse accepts[].network from the envelope and match against the known network registry."},{"id":"X402-D004","severity":"high","summary":"Invalid payTo address.","detail":"The envelope's `accepts[].payTo` is not a well-formed address for the declared network (e.g. not 0x + 40 hex for EVM), so payment cannot reach a recipient.","evidence_recipe":"Validate accepts[].payTo against the network's address format."},{"id":"X402-D005","severity":"high","summary":"resource.url leaks origin (raw IP / non-standard port).","detail":"The advertised resource URL points at a raw IP, localhost, or a non-standard port, leaking the origin and breaking discovery / trust. (Found in ourselves; fixing it is prior art.)","evidence_recipe":"Inspect envelope resource.url; flag raw IP literals, loopback, or :port other than 80/443."},{"id":"X402-D006","severity":"high","summary":"Advertised price != charged amount.","detail":"The amount advertised (docs, listing, discovery extension) differs from the amount in the payment envelope.","evidence_recipe":"Compare envelope accepts[].amount against the publicly advertised price for the same resource."},{"id":"X402-D007","severity":"medium","summary":"No verification route (output cannot be independently checked).","detail":"The service offers no free route to independently verify a signed output, so a caller must trust the issuer.","evidence_recipe":"Look for a verification route in the service's metadata / catalogue; report its absence."},{"id":"X402-D008","severity":"medium","summary":"Unsigned output claimed as verifiable.","detail":"The service claims its output is verifiable but returns no signature over the output.","evidence_recipe":"Check the paid response body for a signature field and a public key; report if both absent despite a verifiability claim."},{"id":"X402-D009","severity":"medium","summary":"Absent / expired authorization window.","detail":"The payment requirements carry no max_timeout_seconds authorization window, or it is already expired / zero, so the payer cannot know how long the signed authorization stays valid.","evidence_recipe":"Read accepts[].max_timeout_seconds; flag missing or <= 0."},{"id":"X402-D010","severity":"low","summary":"No staleness disclosure (undated claims).","detail":"The service's claims or outputs carry no date / freshness signal, so a caller cannot judge currency.","evidence_recipe":"Look for a timestamp / as-of field in metadata and output; report absence."},{"id":"X402-D011","severity":"critical","summary":"200 returned on a paid path without payment.","detail":"Distinct from D001: the path is declared paid but a specific unauthenticated request slips through with 200.","evidence_recipe":"Probe the paid path's known vectors without payment; observe any 200."},{"id":"X402-D012","severity":"low","summary":"No content-type / cache-header discipline on the 402.","detail":"The 402 response lacks an explicit content-type or sane cache headers, so intermediaries may cache or mishandle the challenge.","evidence_recipe":"Read response headers on the 402; require an explicit application/json content-type and a no-store / no-cache cache-control."}]}