Security

What MicroAI does to protect you, and what it does not promise. Last reviewed October 2026.

Controls in place

Sign-in: Sign-In with Ethereum (EIP-4361), bound to this site and to Arc Mainnet. Each sign-in nonce works once and expires after 5 minutes. The session cookie is httpOnly, SameSite=Lax and lasts 24 hours.
Payments: The server reads the transaction receipt from the Arc RPC and checks that it is on Arc Mainnet, succeeded, and that every USDC Transfer log from your wallet to the MicroAI payment wallet matches a valid credit bundle. A transaction can be credited once.
Credits: Credits never expire. If the AI fails to answer, the credit is refunded automatically.
Private keys: MicroAI never asks for a private key or seed phrase. Wallet signing happens in your own wallet.
Abuse limits: Per-IP and per-wallet rate limits on every AI route. Paid routes stop (503) if the limiter is unavailable.
Outbound requests: Requests to other sites go through a guard that allows only https, blocks private and internal addresses, and enforces timeouts and size limits.
Browser protections: HSTS, X-Frame-Options DENY, nosniff, a strict referrer policy, a permissions policy, same-site checks on every write request, and a Content-Security-Policy (currently in report-only mode).
Emergency stop: AI answers and new credit purchases can each be paused by the operator within minutes.

MicroAI is experimental and has not been independently audited. Do not rely on it for large amounts.
AI answers can be wrong. Check addresses and parameters against docs.arc.io before sending funds.
Copilot output is not compiled or tested. Review and test generated code yourself.
Chain data comes from the Arc RPC and Arc Explorer API and is unavailable when they are down.
MicroAI is an independent project, not an official Arc or Circle product.

Please report privately using GitHub Private Vulnerability Reporting. Do not open a public issue, and do not test against other users' wallets or funds.