82 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Email deliverability & domain security check — validates SPF, DKIM (multi-selector), and DMARC, detects spoofing and misconfigurations, and returns an A–F email security grade with transparent deductions. Anti-spam / ant...
Audit a URL's HTTP security headers over a single body-free (HEAD) request. Grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flag...
Site snapshot (SEO + security + tech + email): All four quick checks in one call for a website: on-page SEO score and issues, security headers/TLS grade, tech stack, and the domain's SPF/DKIM/DMARC email authentication....
Email authentication check (SPF, DKIM, DMARC): Check a domain's email authentication and spoofing risk from public DNS: MX and mail provider, SPF (record, all-qualifier, DNS lookup count vs the 10 limit), DMARC policy/pc...
Check the TLS certificate a domain serves on port 443: whether it chains to a trusted root, matches the name (RFC 9525) and when it expires, with issuer, chain, key and signature algorithm, TLS version and coded findings...
CSP Header Review — Reviews ONE Content-Security-Policy header, with any note pasted beside it, and lists only the gaps that let injected script run or let the page be framed, one line each with a fixed code, the directi...
Prüft am Objekt cookie den Befund Wert der CSP-Kopfzeile.
Paid QUIC 0-RTT replay-risk probe (cycle 163, x402 $0.001) - actively probes whether target's QUIC implementation accepts 0-RTT early data + what replay-protection is implemented + whether it's safe to send 0-RTT. 7 axes...
Paid Service Worker + scope security audit (cycle 153) - discovers SW via /sw.js + /service-worker.js + /worker.js + <link rel=serviceworker> + .register() calls, fetches the SW body, audits 11 risk classes (R1 eval/new...
CVE vulnerability lookup by id - full CVE record with description, CVSS base score and severity, CWE weakness, affected products and versions, references, published and modified dates, and the fix. Security vulnerability...
HTTP security headers check for a website: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, plus server and content-type headers, status and final URL. Web security audit, complian...
AI-agent readiness audit, $0.001 USDC per call: How ready is a website for AI agents? Live checks of /llms.txt, robots.txt rules for 12 AI crawlers (GPTBot, ClaudeBot, PerplexityBot, Google-Extended, CCBot…), sitemap.xml...
Paid Set-Cookie security-attribute audit (per-cookie Secure/HttpOnly/SameSite/Max-Age/Size/Priority/Partitioned + issue flags + A-F grade) via x402
Paid JS bundle fingerprint (cycle 192, x402 $0.001) - GET ?url=<PAGE>[&max_scripts=N default 8 max 25] OR ?sample=react|vue|jquery|webpack|alpine|svelte|lodash|angular OR POST {url,max_scripts}. Reads first ~4 KB of each...
Paid HTTP/2 frame-anatomy trace (cycle 180, x402 $0.001) - accepts GET ?host=<HOST> (default www.cloudflare.com); opens fresh TCP+TLS 1.2+ with ALPN [h2, http/1.1]; sends the 24-byte client connection preface PRI * HTTP/...
Paid Trusted Types policy enforcement audit (cycle 164, x402 $0.001) - actively audits W3C Trusted Types policy enforcement by examining 9 axes: (1) CSP require-trusted-types-for 'script' directive presence (the ENFORCEM...
Paid WebTransport handshake + endpoint reachability probe (cycle 165, x402 $0.001) - actively probes RFC 8441 + RFC 9290 + RFC 9221 WebTransport readiness across 8 axes: (1) Alt-Svc h3/h3-NNN advertise parse (HTTP/3 requ...
Paid QUIC spin-bit privacy-leak audit (cycle 164, x402 $0.001) - actively probes RFC 9000 SS15.2 / RFC 9312 spin-bit privacy behavior. Per RFC 9312 SS3.2 the spin bit is the second-most-significant bit of byte 0 of long-...
Paid CDN edge-runtime fingerprint + cold-start probe (cycle 163, x402 $0.001) - actively probes for serverless edge-compute runtimes (Cloudflare Workers/Vercel Edge Functions/Fastly Compute@Edge/Akamai EdgeWorkers/CloudF...
Paid OpenAPI/Swagger security-smell linter per OWASP API Top 10 (2023) (cycle 160 restored 2026-10-17, x402 $0.001) - accepts GET ?url=<TARGET> (walks 6 candidate paths /openapi.json+/openapi.yaml+/swagger.json+/swagger/...
Paid OAuth 2.0 / OIDC authorization endpoint hardening audit (cycle 159, x402 $0.001) - actively probes an issuer's OAuth/OIDC authorization endpoint against the 10 canonical misconfiguration classes defined by RFC 9700...
Paid CSP x Live-Script mapper (cycle 156, x402 $0.001) - fetches target HTML, extracts every <script src=...> URL, and maps each against the target's declared CSP script-src + default-src allow-list. Reports which runnin...
Paid CSP permissive-source budget scorer (cycle 154) - quantifies aggregate attack-surface allowed by the policy. Parses header + meta + report-only delivery mechanisms, classifies every source value as high (script-src...
Paid JWT algorithm-confusion + kid-injection + JWKS-header-hijack probe (cycle 153) - forges 12 forged-JWT attack classes (alg:none variants + kid-injection variants + jku/jwk/x5u attacker-controlled) and (when public_ke...