Read the code before you trust it with a dollar
The network, the wallet, the SDKs and the tools that run it are one public repository under Apache 2.0.
You would not sign a contract you cannot read. We do not ask you to run money on software you cannot read either.
When your agent pays a provider, four things have to behave: the chain, the toolkit that framed the payment, the SDK that signed it and the wallet that approved the limit. On Paxeer X all four are in one public repository, under one license, and anyone can build them from source and compare the result to what the network is running. Trust here is something you verify once, not something you extend every day.
For a founder, this is due diligence done in an afternoon. For a security team, it is the difference between a questionnaire and a reproducible build.
What is in the open
How we keep it honest
- Every change to consensus, custody or a trust boundary starts as a written requirement with acceptance criteria, before any code.
- A maintainer who did not write the change reviews it. No one merges their own work on the parts that move money.
- The same block of transactions is replayed on different compilers, C libraries and processor architectures, and must produce byte-identical state. A single differing byte fails the build.
- Fuzzers and memory sanitizers run against the decoders, the receipt verifier and the program runtime on every change.
- Releases are signed and immutable. A node operator can confirm that the build they installed is the build that was published.
Open source is not a license file. It is a habit of writing things down where other people can check them.
What the license lets you do
Apache 2.0 means you can use, change, embed and sell on top of this code without asking. Fork the SDK into your own product. Run a private copy of the network for testing. Build a competing wallet. The patent grant protects you from us, and the only obligation is to keep the notice. The explorer, as a fork of an existing project, carries that project's open license and is just as free to run yourself.
Contributions are welcome, starting with SDK examples, adapters and documentation in your language.
Found something?
Security reports go through private vulnerability reporting on the repository, so a finding reaches the maintainers before it becomes public. The security policy sets out scope, response times and how we credit researchers.
Clone the repository, build the node, compare its hash to the published release, then run the local environment and watch your own receipts verify. The developer pages show where to start.
Related
Start with the code
Everything on this site is backed by a repository you can read tonight.