Security, stated plainly.

API keys are stored as SHA-256 hashes; the full key is shown exactly once at creation and cannot be recovered — only rotated.

Wallet sign-in uses SIWE (EIP-4361) with single-use, expiring nonces. We never ask for, receive, or store private keys.

x402 payments are wallet-to-wallet on-chain transfers; the wire is never custodian of your funds.

Card payments are processed entirely by Polar as merchant of record — card data never touches our servers.

The API runs on Railway, the site on Vercel; transport is TLS throughout. Live service health is public at muhabbit.com/status.

Found a vulnerability? Write to hello@muhabbit.com with details. Good-faith reports are answered, credited if you want, and never met with legal threats.