Security

• API secrets are hashed (SHA-256); only the prefix is stored in clear for display. Admins cannot retrieve them.
• Webhook secrets are encrypted at rest and shown once.
• No private keys anywhere: the gateway watches addresses, it does not own them.
• Every merchant resource is scoped by merchant and environment — cross-merchant access returns 404, not 403, so ids cannot be probed.
• Public checkout exposes only invoice id, amounts, address, expiry and status.
• Explorer links are generated from server-side network configuration only.
• Structured logs redact bearer tokens, secrets and provider keys.

Report vulnerabilities to the operator's security contact before public disclosure.