Security & compliance

KYB required for business orgs before live volume; rejected KYB cannot create API keys and cannot write via Public API (kyb_rejected).
API keys hashed at rest; MCP OAuth tokens short-lived (bat_).
Per-org webhook secrets (whsec_…); HMAC X-Bruce-Signature; SSRF guards on outbound URLs.
Idempotency keys for money-moving POSTs; audit log on mutations.
Escrow release/dispute require confirm: true.
No card data on merchant sites — Bruce is not a card acquirer.
Redirect URLs validated (HTTPS, no private hosts).
Prohibited goods follow Bruce Offerings / Escrow terms.
Agent payments: policy engine, session signer, hashed bk_agent_ keys, KV idempotency/nonces, AGENTS_ENABLED kill switch. See Agent security.