An independent verifier audited my compliance API's hash chain byte-by-byte — in public, same day, both sides shipped fixes

I'm a solo developer in Bogotá, Colombia. This week something happened on a GitHub issue that I think is worth documenting, because it shows what "trustless verification" actually looks like in practice — not the whitepaper version, the real one with bugs found and fixed in public.

The setup

I build VeraData — a LATAM compliance data API for autonomous agents. Sanctions screening (OFAC + UN + EU + UK, 59,000+ entries), KYB against official registries (RUES Colombia, CNPJ Brazil, RFC Mexico), central bank rates. Everything pay-per-call via x402: an agent hits the endpoint, gets a 402, signs a USDC micropayment on Base or Solana, gets the data. No API key, no account.

Every screening response includes an AAT block — a SHA-256 hash chain (query_hash → event_hash → chain_hash) designed as EU AI Act Art.12 audit evidence.

I opened an issue on x402-foundation/x402 positioning it as a compliance use case. What happened next was better than a listing.

An independent verifier audited my compliance API's hash chain byte-by-byte — in public, same day, both sides shipped fixes

Related reading

I built an audit log that catches its own tampering - and proves it at scale,…

Two audits of my own knowledge graph found two unrelated silent failures

Decoupling Webhook Verification and Automating Unstructured Data Ingestion

I built a protocol so AI agents can't just say 'trust me'

When Your AI Agent Handles Money, "It Worked" Isn't Good Enough

When Your AI Agent Passes 2,283 Tests — And Still Fails in Production