Vulnerability data, scanning and audit services. A listing here is not an endorsement of the scanner’s accuracy.
CVE vulnerability lookup by id - full CVE record with description, CVSS base score and severity, CWE weakness, affected products and versions, references, published and modified dates, and the fix. ALIAS PATH of /api/cve...
CISA known exploited vulnerabilities KEV check for a CVE - is this CVE in CISA's Known Exploited Vulnerabilities catalog, the date it was added, the federal remediation due date, whether it is used in a known ransomware...
CISA known exploited vulnerabilities KEV check for a CVE - is this CVE in CISA's Known Exploited Vulnerabilities catalog, the date it was added, the federal remediation due date, whether it is used in a known ransomware...
Paid Service Worker + scope security audit (cycle 153) - discovers SW via /sw.js + /service-worker.js + /worker.js + <link rel=serviceworker> + .register() calls, fetches the SW body, audits 11 risk classes (R1 eval/new...
Paid HTTP security header audit (CSP/HSTS/X-Frame-Options/etc) via x402
Paid composite agent-trustworthiness score — security headers (HTTPS/HSTS/CSP/XFO/XCTO/RP/PP) + discoverability (robots/sitemap/llms.txt/security.txt) + standards (structured data/lang/cookie consent) rollup with A-F gra...
Paid canonical URL consensus audit — link rel=canonical + HTTP redirect final + og:url + twitter:url + JSON-LD url/@id/mainEntityOfPage + hreflang x-default compared, consensus URL + agreement_count + canonical_health_sc...
Paid deep WCAG 2.1/2.2 AA accessibility audit — forms+inputs (label/aria-label/aria-labelledby/placeholder), autocomplete token validity, button+link accessible-name, heading hierarchy (skip-level + multiple-h1 detection...
Paid security exposure-surface audit — HSTS preload-list membership via hstspreload.org API + HSTS header detection, RFC 9116 security.txt presence+format-validity (Contact/Expires/Canonical/Preferred-Languages), 18-path...
Paid per-cookie security-flags deep audit — parses every Set-Cookie individually for SameSite (Strict/Lax/None/missing/Lax-by-default-heuristic) + Secure + HttpOnly + Path + Domain (broad-domain detection) + Max-Age + Ex...
Paid security.txt RFC 9116 deep audit — path discovery tries /.well-known/security.txt then /security.txt, parses all fields with line-continuation support, strict Contact format validation (mailto: + https://), strict E...
Paid HTTP-method policy + dangerous-method exposure audit — OPTIONS Allow/DAV/ACAO/ACAM + TRACE echo-back + CONNECT + PUT/DELETE/PATCH write exposure + 4 method-override header sniffing (X-HTTP-Method-Override/X-Method-O...
Paid cache-freshness strategy audit — probes HTML page + /favicon.ico + /robots.txt + /sitemap.xml + first stylesheet URL + first script URL; for each captures Cache-Control directives + ETag + Last-Modified + Age + Vary...
Paid deep Content-Security-Policy analyzer — parses ALL 4 CSP delivery mechanisms (header + meta + report-only variants), classifies each source value (wildcard/scheme/host/nonce/hash/unsafe-inline/unsafe-eval/strict-dyn...
Paid form security + accessibility audit — per-form action analysis (empty/#/javascript:/data:/mixed-content http-on-https), method (GET with passwords = credential-in-URL), enctype (text/plain CRLF injection), target=_b...
Paid redirect-chain security audit — full chain traversal (max 10 hops), open-redirect detection (//, @, javascript:), cross-domain count, https-only check, meta-refresh detection, redirect-security_score A-F grade via x...
Paid deep HTTP header policy audit — 30+ headers across 12 groups: CSP (Content-Security-Policy + Report-Only) + HSTS (max-age + includeSubDomains) + COOP/COEP/CORP/Origin-Agent-Cluster + Permissions-Policy (feature list...
Paid active HTTP/2 SETTINGS frame probe (cycle 106) — opens fresh TCP, performs TLS 1.3 handshake with ALPN ["h2", "http/1.1"], sends the HTTP/2 client connection preface (PRI * HTTP/2.0 + 24-byte magic + client SETTINGS...
Paid brand-impersonation risk synthesis (cycle 106) — aggregates 8 signals (domain age via crt.sh, BIMI RFC 8848 record, RFC 9116 security.txt, llms.txt presence, /.well-known/x402 honest declaration, https→http redirect...
Paid deep WAI-ARIA accessibility audit (cycle 113) — parses every element with role= or aria-*, checks INTERACTIVE ROLES MISSING ACCESSIBLE NAMES (button/checkbox/combobox/img/link/listbox/menu/menuitem/option/progressba...
Paid clickjacking-protection audit (cycle 115) — fetches the page headers + body, audits (a) X-Frame-Options presence + value (DENY/SAMEORIGIN valid, ALLOW-FROM deprecated per Chrome/Edge), (b) CSP frame-ancestors policy...
Paid Permissions-Policy + Feature-Policy header audit (cycle 124, x402 $0.001) - fetches target URL + iterates ALL Permissions-Policy (modern) AND Feature-Policy (legacy) headers, parses 17 tracked features (camera/micro...
Paid HTTP request-smuggling CL.TE/TE.CL/TE.TE tolerance evidence probe (cycle 129, x402 $0.001) - opens low-level socket (bypasses urllib header normalization) to target host, sends 6 PortSwigger-style evidence requests...
Paid WebAssembly CSP + wasm-unsafe-eval coverage analyzer (cycle 137, x402 $0.001) - fetches target URL, scans for WASM indicators (inline WebAssembly.instantiate/compile + .wasm file references + <link rel=preload as=fe...