Pricing a security answer by value, not by cost

A 402 endpoint over Certly’s URL reputation API. The 402 mechanism is the same across this family of experiments; what is interesting here is the price.

2700 satoshis, against 720 for the stock tickers in the same family. Nearly four times the price for a call with comparable upstream cost. That was deliberate and it is the right instinct: the value of knowing a link is hostile has nothing to do with what the lookup costs to perform. Cost-plus pricing is the default and it is wrong whenever value varies by query, which for a security answer it wildly does. A negative result on a link you already distrusted is worth almost nothing; a positive on one you were about to click is worth a great deal, and you cannot know which you are buying until after you have paid.

The code has a real problem I would not ship now. The target URL is concatenated straight into the upstream query string with no validation or encoding, so a URL containing an & splits into extra parameters and at worst lets a caller manipulate the upstream request. urlencode is the whole fix.

Caching is the other unresolved piece: a reputation verdict changes over time, so a cache that improves margin serves stale answers about exactly the links that just became dangerous.