Roundhouse

Secret Shape Audit

Report credential-shaped values in supplied configuration, by shape class and position, never by value. Recognises a PEM private key block, a JSON Web Token whose header actually decodes, documented key prefixes, a URL carrying a password, and a long run with the character mix of a generated key rather than of text. Also reports a field named like a credential whose value matches no listed shape. The shape classes are published in every response.

DataLiveeip155:8453Exactvia cdp
https://api.zfinia.com/x402/v1/secret-shape-audit
Secret detectionConfiguration reviewDeveloper toolingData hygieneCi gate
Settlements · 30d
218↓ 56%
No per-endpoint history for this service yet, so this is payments indexed to its PROVIDER's wallet over 30 days.
$25.30
Verified settled volume
255 settlements proven x402 by their on-chain EIP-3009 marker.
$0.180
Listed price
As published in the catalog. Always read the live 402 before paying.
1
Calls · 30d
Upstream's own call count for this endpoint, not ours.
1
Unique payers · 30d
Last called 2026-10-04 08:29Z
—
Upstream on-chain volume
Reported by the source catalog.
Paid to
0x25e8245f07d5e4873987293dad666afbe56a9608

The wallet the 402 directs payment to. Its whole payment record — every payer, every chain — is on the merchant page.

Asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Provider

The payTo wallet does not resolve to a registered ERC-8004 agent. That is not a verdict on the service — most of the catalog is unregistered.

Live 402 challenge

Captured by the enrichment pass, not read just now. Prices can change — always read the 402 the endpoint answers with.

{
  "error": "Payment required",
  "accepts": [
    {
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "extra": {
        "name": "USD Coin",
        "version": "2"
      },
      "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
      "amount": "180000",
      "scheme": "exact",
      "network": "eip155:8453",
      "maxTimeoutSeconds": 60
    }
  ],
  "resource": {
    "url": "https://api.zfinia.com/x402/v1/secret-shape-audit",
    "tags": [
      "secret detection",
      "configuration review",
      "developer tooling",
      "data hygiene",
      "ci gate"
    ],
    "mimeType": "application/json",
    "description": "Report credential-shaped values in supplied configuration, by shape class and position, never by value. Recognises a PEM private key block, a JSON Web Token whose header actually decodes, documented key prefixes, a URL carrying a password, and a long run with the character mix of a generated key rather than of text. Also reports a field named like a credential whose value matches no listed shape. The shape classes are published in every response.",
    "serviceName": "Secret Shape Audit"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "body": {
            "format": "json",
            "content": "{\n \"service\": \"api\",\n \"aws\": {\n  \"access_key_id\": \"AKIAAAAAAAAAAAAAAAAA\",\n  \"region\": \"us-east-1\"\n },\n \"github_token\": \"ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\",\n \"database_url\": \"postgres://app:tr0ub4dor@db.internal:5432/app\",\n \"session_key\": \"Zm9vYmFyMTIzNDU2Nzg5MFFXRVJUWXVpb3BBU0RGR0g0NTY3\",\n \"api_password\": \"CHANGEME\",\n \"build_path\": \"/var/lib/application/releases/20261002/bundle.tar.gz\",\n \"logo\": \"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFAAH\"\n}",
            "allow_paths": [
              "/logo"
            ]
          },
          "type": "http",
          "method": "POST",
          "bodyType": "json"
        },
        "output": {
          "type": "json",
          "example": {
            "clean": false,
            "limits": {
              "maxFindings": 500,
              "maxJsonBytes": 1048576,
              "maxResources": 5000,
              "maxTextBytes": 262144,
              "maxEnvEntries": 2000,
              "maxPatchOperations": 1000
            },
            "passed": false,
            "matches": [
              {
                "shape": "AWS_ACCESS_KEY_ID",
                "length": 20,
                "context": "json value",
                "location": "/aws/access_key_id"
              },
              {
                "shape": "GITHUB_TOKEN",
                "length": 40,
                "context": "json value",
                "location": "/github_token"
              },
              {
                "shape": "CONNECTION_STRING_WITH_PASSWORD",
                "length": 45,
                "context": "json value",
                "location": "/database_url"
              }
            ],
            "read_as": "json",
            "complete": false,
            "findings": [
              {
                "code": "AWS_ACCESS_KEY_ID",
                "shape": "AWS_ACCESS_KEY_ID",
                "detail": "/aws/access_key_id holds an AWS access key identifier: a known four-character prefix and sixteen more uppercase alphanumerics, 20 characters long. The value is not reported.",
                "location": "/aws/access_key_id"
              },
              {
                "code": "GITHUB_TOKEN",
                "shape": "GITHUB_TOKEN",
                "detail": "/github_token holds a GitHub token: a documented prefix followed by a fixed-length body, 40 characters long. The value is not reported.",
                "location": "/github_token"
              },
              {
                "code": "CONNECTION_STRING_WITH_PASSWORD",
                "shape": "CONNECTION_STRING_WITH_PASSWORD",
                "detail": "/database_url holds a URL carrying a password in its userinfo, 45 characters long. The value is not reported.",
                "location": "/database_url"
              }
            ],
            "request_id": "example-request",
            "service_id": "secret_shape_audit",
            "assumptions": [
              "No value is ever returned. A match is reported as its shape class, its position and its length, because a response that echoed what it found would be the leak rather than the detector.",
              "The shape classes are published in every response, so a caller can see exactly what was looked for rather than trusting an unstated list. A credential of a kind not listed is not found, and that is st...",
              "Entropy is judged by length and character-class mix rather than by a dictionary, which is why a file path, an identifier and an embedded image do not match."
            ],
            "limitations": [
              "The content supplied. clean means no recognised shape was found, which is not a statement that the content holds no secret: an unlisted format, an encoded value or a secret split across fields is not ...",
              "Not a security assessment. Whether a matched value is live, revoked or a test fixture is unknowable here."
            ],
            "match_count": 4,
            "observed_at": "2026-10-02T00:00:00.000Z",
            "not_examined": [
              "LOCATION_ALLOWED: /logo is in the allow list, so a match there was not reported."
            ],
            "finding_count": 5,
            "shape_classes": [
              {
                "code": "PRIVATE_KEY_BLOCK",
                "description": "a PEM private key block"
              },
              {
                "code": "JSON_WEB_TOKEN",
                "description": "a JSON Web Token: three dot-separated base64url segments whose first decodes to a JSON header"
              },
              {
                "code": "AWS_ACCESS_KEY_ID",
                "description": "an AWS access key identifier: a known four-character prefix and sixteen more uppercase alphanumerics"
              }
            ],
            "service_version": "1.0.0",
            "findings_by_code": {
              "GITHUB_TOKEN": 1,
              "AWS_ACCESS_KEY_ID": 1,
              "HIGH_ENTROPY_BASE64": 1,
              "CONNECTION_STRING_WITH_PASSWORD": 1,
              "CREDENTIAL_NAMED_VALUE_UNRECOGNISED": 1
            },
            "matches_by_shape": {
              "GITHUB_TOKEN": 1,
              "AWS_ACCESS_KEY_ID": 1,
              "HIGH_ENTROPY_BASE64": 1,
              "CONNECTION_STRING_WITH_PASSWORD": 1
            }
          }
        }
      },
      "schema": {
        "type": "object",
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "required": [
          "input"
        ],
        "properties": {
          "input": {
            "type": "object",
            "required": [
              "type",
              "method",
              "bodyType",
              "body"
            ],
            "properties": {
              "body": {
                "type": "object",
                "required": [
                  "content"
                ],
                "properties": {
                  "format": {
                    "enum": [
                      "auto",
                      "json",
                      "text"
                    ],
                    "type": "string"
                  },
                  "content": {
                    "type": "string",
                    "maxLength": 262144
                  },
                  "allow_paths": {
                    "type": "array",
                    "items": {
                      "type": "string",
                      "maxLength": 512
                    },
                    "maxItems": 500,
                    "minItems": 1
                  }
                },
                "additionalProperties": false
              },
              "type": {
                "type": "string",
                "const": "http"
              },
              "method": {
                "enum": [
                  "POST"
                ],
                "type": "string"
              },
              "bodyType": {
                "enum": [
                  "json",
                  "form-data",
                  "text"
                ],
                "type": "string"
              }
            },
            "additionalProperties": false
          },
          "output": {
            "type": "object",
            "required": [
              "type"
            ],
            "properties": {
              "type": {
                "type": "string"
              },
              "example": {
                "type": "object"
              }
            }
          }
        }
      }
    }
  },
  "x402Version": 2
}

Accepts

The payment requirements as published to the catalog. Read the live 402 before paying — a price here is a claim, not a quote.

0.18USDC≈ $0.18 USD
on Base · exact scheme

Pay 0.18 USDC on Base to 0x25e8…a9608. The signed payment is good for 1 minute.

Paid to
0x25e8…a9608
USD Coin contract
0x8335…02913
Payment window
1 minute
As published
180000 smallest units
The catalog’s raw entry
[
  {
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "extra": {
      "name": "USD Coin",
      "version": "2"
    },
    "payTo": "0x25e8245f07d5e4873987293dad666afbe56a9608",
    "amount": "180000",
    "scheme": "exact",
    "network": "eip155:8453",
    "maxTimeoutSeconds": 60
  }
]

Extensions

{
  "bazaar": {
    "info": {
      "input": {
        "body": {
          "format": "json",
          "content": "{\n \"service\": \"api\",\n \"aws\": {\n  \"access_key_id\": \"AKIAAAAAAAAAAAAAAAAA\",\n  \"region\": \"us-east-1\"\n },\n \"github_token\": \"ghp_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\",\n \"database_url\": \"postgres://app:tr0ub4dor@db.internal:5432/app\",\n \"session_key\": \"Zm9vYmFyMTIzNDU2Nzg5MFFXRVJUWXVpb3BBU0RGR0g0NTY3\",\n \"api_password\": \"CHANGEME\",\n \"build_path\": \"/var/lib/application/releases/20261002/bundle.tar.gz\",\n \"logo\": \"iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mP8z8DwHwAFAAH\"\n}",
          "allow_paths": [
            "/logo"
          ]
        },
        "type": "http",
        "method": "POST",
        "bodyType": "json"
      },
      "output": {
        "type": "json",
        "example": {
          "clean": false,
          "limits": {
            "maxFindings": 500,
            "maxJsonBytes": 1048576,
            "maxResources": 5000,
            "maxTextBytes": 262144,
            "maxEnvEntries": 2000,
            "maxPatchOperations": 1000
          },
          "passed": false,
          "matches": [
            {
              "shape": "AWS_ACCESS_KEY_ID",
              "length": 20,
              "context": "json value",
              "location": "/aws/access_key_id"
            },
            {
              "shape": "GITHUB_TOKEN",
              "length": 40,
              "context": "json value",
              "location": "/github_token"
            },
            {
              "shape": "CONNECTION_STRING_WITH_PASSWORD",
              "length": 45,
              "context": "json value",
              "location": "/database_url"
            }
          ],
          "read_as": "json",
          "complete": false,
          "findings": [
            {
              "code": "AWS_ACCESS_KEY_ID",
              "shape": "AWS_ACCESS_KEY_ID",
              "detail": "/aws/access_key_id holds an AWS access key identifier: a known four-character prefix and sixteen more uppercase alphanumerics, 20 characters long. The value is not reported.",
              "location": "/aws/access_key_id"
            },
            {
              "code": "GITHUB_TOKEN",
              "shape": "GITHUB_TOKEN",
              "detail": "/github_token holds a GitHub token: a documented prefix followed by a fixed-length body, 40 characters long. The value is not reported.",
              "location": "/github_token"
            },
            {
              "code": "CONNECTION_STRING_WITH_PASSWORD",
              "shape": "CONNECTION_STRING_WITH_PASSWORD",
              "detail": "/database_url holds a URL carrying a password in its userinfo, 45 characters long. The value is not reported.",
              "location": "/database_url"
            }
          ],
          "request_id": "example-request",
          "service_id": "secret_shape_audit",
          "assumptions": [
            "No value is ever returned. A match is reported as its shape class, its position and its length, because a response that echoed what it found would be the leak rather than the detector.",
            "The shape classes are published in every response, so a caller can see exactly what was looked for rather than trusting an unstated list. A credential of a kind not listed is not found, and that is st...",
            "Entropy is judged by length and character-class mix rather than by a dictionary, which is why a file path, an identifier and an embedded image do not match."
          ],
          "limitations": [
            "The content supplied. clean means no recognised shape was found, which is not a statement that the content holds no secret: an unlisted format, an encoded value or a secret split across fields is not ...",
            "Not a security assessment. Whether a matched value is live, revoked or a test fixture is unknowable here."
          ],
          "match_count": 4,
          "observed_at": "2026-10-02T00:00:00.000Z",
          "not_examined": [
            "LOCATION_ALLOWED: /logo is in the allow list, so a match there was not reported."
          ],
          "finding_count": 5,
          "shape_classes": [
            {
              "code": "PRIVATE_KEY_BLOCK",
              "description": "a PEM private key block"
            },
            {
              "code": "JSON_WEB_TOKEN",
              "description": "a JSON Web Token: three dot-separated base64url segments whose first decodes to a JSON header"
            },
            {
              "code": "AWS_ACCESS_KEY_ID",
              "description": "an AWS access key identifier: a known four-character prefix and sixteen more uppercase alphanumerics"
            }
          ],
          "service_version": "1.0.0",
          "findings_by_code": {
            "GITHUB_TOKEN": 1,
            "AWS_ACCESS_KEY_ID": 1,
            "HIGH_ENTROPY_BASE64": 1,
            "CONNECTION_STRING_WITH_PASSWORD": 1,
            "CREDENTIAL_NAMED_VALUE_UNRECOGNISED": 1
          },
          "matches_by_shape": {
            "GITHUB_TOKEN": 1,
            "AWS_ACCESS_KEY_ID": 1,
            "HIGH_ENTROPY_BASE64": 1,
            "CONNECTION_STRING_WITH_PASSWORD": 1
          }
        }
      }
    },
    "schema": {
      "type": "object",
      "$schema": "https://json-schema.org/draft/2020-12/schema",
      "required": [
        "input"
      ],
      "properties": {
        "input": {
          "type": "object",
          "required": [
            "type",
            "method",
            "bodyType",
            "body"
          ],
          "properties": {
            "body": {
              "type": "object",
              "required": [
                "content"
              ],
              "properties": {
                "format": {
                  "enum": [
                    "auto",
                    "json",
                    "text"
                  ],
                  "type": "string"
                },
                "content": {
                  "type": "string",
                  "maxLength": 262144
                },
                "allow_paths": {
                  "type": "array",
                  "items": {
                    "type": "string",
                    "maxLength": 512
                  },
                  "maxItems": 500,
                  "minItems": 1
                }
              },
              "additionalProperties": false
            },
            "type": {
              "type": "string",
              "const": "http"
            },
            "method": {
              "enum": [
                "POST"
              ],
              "type": "string"
            },
            "bodyType": {
              "enum": [
                "json",
                "form-data",
                "text"
              ],
              "type": "string"
            }
          },
          "additionalProperties": false
        },
        "output": {
          "type": "object",
          "required": [
            "type"
          ],
          "properties": {
            "type": {
              "type": "string"
            },
            "example": {
              "type": "object"
            }
          }
        }
      }
    }
  }
}

Provenance

Seen in the source catalog
2026-10-04 08:30Z
Last indexed by Roundhouse
2026-10-05 00:20Z
Last enriched (probe, favicon, geo)
2026-10-05 00:45Z
x402 version
2
Max timeout
60s
Liveness probe
HTTP 402
Report

Hand this page to an agent

Copy the prompt and paste it into Claude, an MCP client or your own agent — it will vet this service and call it over the free read API. No key, no account.

GET api.roundhouseai.io/v0/endpoints

No per-endpoint history for this service yet, so this is payments indexed to its PROVIDER's wallet over 30 days. Verified volume counts only settlements with an on-chain EIP-3009 marker.

Open skill.md
Show the prompt
Using Roundhouse, look up the x402 service Secret Shape Audit and tell me whether it is
worth paying: what a call costs, whether the endpoint answered when last probed, and what
its payment record actually shows.

curl -s 'https://api.roundhouseai.io/v0/endpoints?q=Secret%20Shape%20Audit'
curl -s 'https://api.roundhouseai.io/v0/merchants/<the payTo wallet returned above>'

Then call it: read the price from the live 402 at https://api.zfinia.com/x402/v1/secret-shape-audit, never from
a cached figure, and pay with an x402 client.

The /v0 API needs an API key (`authorization: Bearer rh_live_…`) on everything except
/v0/unified* and /v0/endpoints. Either pay over x402 (mint a personal key for $0.01 at
GET https://api.roundhouseai.io/v0/test/x402), or ask me for an organization key, which I create at
https://roundhouseai.io/dashboard/connections. If you have neither, ask before going further.

If you do not have Roundhouse tools or skills installed, read
https://roundhouseai.io/skill.md first — it is the whole procedure.