Security
Rill lets you accept payments from agents and lets your agents pay on the web. This page summarizes access controls, money safeguards, and how to report vulnerabilities.
Architecture
The website, API, and MCP server are separate services. Accept and Spend settle through Stripe when connected. Transfers inside Rill support handle sends and Connect withdraw. Browser calls to /api/* are rewritten to the API (the API itself has no /api prefix).
Access control
- Owner dashboard sessions use a signed owner token (invalid token → 401).
- Seller Accept keys use rill_sk_* prefixes.
- Agent wallets use rill_vw_* with period allowances and optional allowlists.
- Mutating writes expect Idempotency-Key; responses include request_id / X-Request-Id.
- Webhooks are signed with X-Rill-Signature and X-Rill-Timestamp.
Money and receipts
Pays on the web settle in Stripe. Transfers inside Rill settle on the Rill ledger. Receipts are re-verifiable; sellers should store used receipt_id values for one-time unlock. Pay pages under /r/ are not indexed.
Privacy and terms
Report a vulnerability
Email security@userill.com with a clear description, impact, and steps to reproduce. Give us reasonable time to investigate before public disclosure.
Use security@ only for vulnerabilities. Privacy requests go to privacy@userill.com. Terms and contract questions go to legal@userill.com. Abuse reports go to abuse@userill.com.