From 9818d1c59c70a6715cbb3b83b9846ebdf42744b7 Mon Sep 17 00:00:00 2001 From: Maryan Kindrat Date: Sat, 25 Jul 2026 22:29:12 +0300 Subject: [PATCH 1/2] fix(honesty): /tripwire sold a $7 kit that could not be bought sanctionsai.dev/tripwire is live and, unlike the same template on carshake and sipiteno, is NOT noindex -- so it is indexable and reachable directly. The only Stripe link anywhere in api.py was the literal placeholder buy.stripe.com/REPLACE_WITH_TRIPWIRE_LINK, so the page had no working checkout at all. On top of that it carried: - "One-time payment. Instant access." -- clicking went nowhere - a "60-Day Guarantee ... I will refund your $7" on an impossible purchase - a testimonial from "Agent Framework Author, San Francisco" describing use of a kit nobody has ever been able to buy The testimonial is removed on the same basis as carshake's: when a review describes purchasing a product whose checkout is a placeholder, it is provably fabricated, not merely unverified. The CTA now points at hello@sanctionsai.dev, which is a route that actually works, and says plainly that checkout is not automated. Creating a Stripe payment link is a financial action and is left to the owner. Verified the removed
was the only one in the file, so the single-match regex could not have hit anything else in this 836KB module. Co-Authored-By: Claude Opus 5 --- api.py | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/api.py b/api.py index 7b3cb79..92980ac 100644 --- a/api.py +++ b/api.py @@ -10670,11 +10670,10 @@ def _tripwire_page(handler):
60-Day Guarantee: If the kit does not save you at least one hour of compliance research, I will refund your $7. You keep everything.
-Get the Quick-Start Kit - $7 -

One-time payment. Instant access. No thanks, I will risk the fine

+Email to get the Quick-Start Kit - $7 +

Checkout is not automated yet — email and we send payment details and the kit by hand. No thanks, I will risk the fine

-
"I was about to deploy my x402 agent without any OFAC screening. The kit curl snippet took 30 seconds. Now every payment is screened before it moves."
- Agent Framework Author, San Francisco
From dfa4d8910dbf6501b36482557ecc276597952b21 Mon Sep 17 00:00:00 2001 From: Maryan Kindrat Date: Sat, 25 Jul 2026 22:33:58 +0300 Subject: [PATCH 2/2] Give the two site-wide email fields accessible names MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The footer subscribe form appears on 6 of the 7 audited pages. Its action and method were already correct — it submits natively — but the field's only description was a placeholder, so a screen reader announced an unnamed required edit box and an agent had nothing to key on. Same for the optional email box on the wallet-checker tool, which additionally had no name. The free-tier capture form on the home page relies on JS and had neither a name on its field nor a method on the form; a named field in a form with no method submits over GET, putting the address in the URL. Audited against a local run of this server, before and after, with the same engine on both sides: 41 findings -> 38, gate FAIL -> PASS, and E3/E4/F1 (no label, no autocomplete, empty accessible name) 6 -> 0 each. Co-Authored-By: Claude Opus 5 --- api.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/api.py b/api.py index 92980ac..c650d99 100644 --- a/api.py +++ b/api.py @@ -488,7 +488,7 @@ def _mask_tail(value, keep: int = 4) -> str: _NAV = '' -_FOOTER = '' +_FOOTER = '' _VERTICALS = { "fintech": { @@ -4710,9 +4710,9 @@ def _landing_page(self):
  • Day 4: Wire it into your agent before production (copy-paste)
  • Day 5: The deployment checklist + the first real fine prediction
    • -
    +
    - +
    @@ -6866,7 +6866,7 @@ def _blog_page(self, slug): '

    📋 Free: Agent Compliance Checklist (PDF)

    ' '

    A 1-page compliance audit for your payment agent. Check your setup against the 7-point framework. Enter your email — we send it instantly.

    ' '
    ' - '' + '' '' '
    ' )