Security model

Threat	Mitigation	Residual risk
Key theft from the agent runtime	the key is never in the agent; CDP server wallet by default	sidecar host compromise → keep balances small, add CDP server-side policies
Prompt injection steering payments	policy outside the model, readable refusals	—
Fake 402 / recipient swap	policy on the real request host, payTo pins, first-payment cap, price-jump check	unpinned hosts
Double payment	sign once per decision, never retry after sending, Idempotency-Key, payment-identifier, nonce uniqueness	—
Budget race between agents	reservation inside SQLite BEGIN IMMEDIATE	several sidecars on separate ledgers (use one sidecar; pooled budgets in the control plane are planned for Team)
Agent approves itself	admin token only; review links bound by HMAC; GET never acts	agents with shell access to the token file → separate OS user/container
Sensitive data in logs	no headers/bodies, query strings dropped	—

Report vulnerabilities privately to security@spendctl.dev.