diff --git a/node/beacon_x402.py b/node/beacon_x402.py
index ec833e18a..a1de7ec90 100644
--- a/node/beacon_x402.py
+++ b/node/beacon_x402.py
@@ -317,9 +317,12 @@ def premium_contracts_export():
             return err_resp
 
         db = get_db_func()
-        rows = db.execute(
-            "SELECT * FROM contracts ORDER BY created_at DESC"
-        ).fetchall()
+        try:
+            rows = db.execute(
+                "SELECT * FROM contracts ORDER BY created_at DESC"
+            ).fetchall()
+        except Exception:
+            rows = []
 
         contracts = []
         for r in rows:
@@ -331,7 +334,7 @@ def premium_contracts_export():
                     "SELECT coinbase_address FROM beacon_wallets WHERE agent_id = ?",
                     (agent_id,),
                 ).fetchone()
-                d[f"{field}_wallet"] = wallet_row["coinbase_address"] if wallet_row else None
+                d[f"{field}_wallet"] = dict(wallet_row).get("coinbase_address") if wallet_row else None
             contracts.append(d)
 
         return _cors_json({
diff --git a/node/server_proxy.py b/node/server_proxy.py
index 8aad4ef10..20cd814f3 100644
--- a/node/server_proxy.py
+++ b/node/server_proxy.py
@@ -59,7 +59,9 @@ def proxy(path):
     except requests.exceptions.Timeout:
         return jsonify({'error': 'Local server timeout'}), 504
     except Exception as e:
-        return jsonify({'error': str(e)}), 500
+        import logging
+        logging.error(f"Server proxy upstream error: {e}")
+        return jsonify({'error': 'Local server unavailable'}), 502
 
 @app.route('/status')
 def status():
diff --git a/otc-bridge/otc_bridge.py b/otc-bridge/otc_bridge.py
index 711eccc5f..ab096efd7 100644
--- a/otc-bridge/otc_bridge.py
+++ b/otc-bridge/otc_bridge.py
@@ -430,6 +430,8 @@ def rtc_cancel_escrow(job_id, poster_wallet):
 def create_order():
     """Create a new buy or sell order."""
     data = request.get_json(silent=True)
+    if data is not None and not isinstance(data, dict):
+        return jsonify({"error": "expected JSON object"}), 400
     if not data:
         return jsonify({"error": "JSON body required"}), 400