1,159 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid WAF/IDS/CDN-edge fingerprint detector — 28-vendor catalog (Cloudflare/Fastly/Akamai/Imperva/Sucuri/CloudFront/ALB/Azure-FrontDoor/Vercel/Netlify/StackPath/KeyCDN/BunnyCDN/F5-BIGIP/Barracuda/Citrix-NetScaler/ModSecur...
Paid per-cookie security-flags deep audit — parses every Set-Cookie individually for SameSite (Strict/Lax/None/missing/Lax-by-default-heuristic) + Secure + HttpOnly + Path + Domain (broad-domain detection) + Max-Age + Ex...
Paid security.txt RFC 9116 deep audit — path discovery tries /.well-known/security.txt then /security.txt, parses all fields with line-continuation support, strict Contact format validation (mailto: + https://), strict E...
Paid HTTP-method policy + dangerous-method exposure audit — OPTIONS Allow/DAV/ACAO/ACAM + TRACE echo-back + CONNECT + PUT/DELETE/PATCH write exposure + 4 method-override header sniffing (X-HTTP-Method-Override/X-Method-O...
Paid deep Content-Security-Policy analyzer — parses ALL 4 CSP delivery mechanisms (header + meta + report-only variants), classifies each source value (wildcard/scheme/host/nonce/hash/unsafe-inline/unsafe-eval/strict-dyn...
Paid form security + accessibility audit — per-form action analysis (empty/#/javascript:/data:/mixed-content http-on-https), method (GET with passwords = credential-in-URL), enctype (text/plain CRLF injection), target=_b...
Paid cache-freshness strategy audit — probes HTML page + /favicon.ico + /robots.txt + /sitemap.xml + first stylesheet URL + first script URL; for each captures Cache-Control directives + ETag + Last-Modified + Age + Vary...
Paid JavaScript sourcemap exposure audit — fetches every external <script src> + probes inline-script //# sourceMappingURL= references + tries each .map URL via HEAD to surface public source-leak risk, sourcemaps_referen...
Paid CDN-edge fingerprint detector — 24-vendor catalog (Cloudflare/CloudFront/Fastly/Akamai/Vercel/Netlify/Google Cloud CDN/Azure Front Door/StackPath/BunnyCDN/KeyCDN/Cloudflare Workers/F5/WordPress VIP/Rackspace/Edgecas...
Paid HTTP/3 + Alt-Svc endpoint-discovery audit — parses RFC 7838 Alt-Svc header for h3/h3-29 protocol advertisement, captures port + host + max-age + persistent flag, reports advertised_h3, advertised_h3_port, advertised...
Paid redirect-chain security audit — full chain traversal (max 10 hops), open-redirect detection (//, @, javascript:), cross-domain count, https-only check, meta-refresh detection, redirect-security_score A-F grade via x...
Paid auth-method discovery — WWW-Authenticate header + RFC 8414 oauth-authorization-server + OpenID Connect discovery + JWKS + RFC 8705 oauth-protected-resource + login-form introspection, surfaces bearer/basic/oauth2/oi...
Paid JavaScript framework + build-tool fingerprint — 11 detection surfaces (generator meta + data-* attrs + __NEXT_DATA__/__NUXT__/__remixContext + SPA root mount points + build-output paths /_next/_nuxt/_astro/build + J...
Paid error-response fingerprint + leakiness audit — 12-probe matrix (api-404/admin-path/.env/phpmyadmin/debug/wp-admin/graphql-invalid/internal-api/bad-json/wrong-accept/long-path/spoofed-loopback), captures per-probe st...
Paid deep HTTP header policy audit — 30+ headers across 12 groups: CSP (Content-Security-Policy + Report-Only) + HSTS (max-age + includeSubDomains) + COOP/COEP/CORP/Origin-Agent-Cluster + Permissions-Policy (feature list...
Paid composite AI-agent friendliness score — rolls up 9 AI-relevant discovery surfaces (llms.txt + llms-full.txt + sitemap.xml + RSS/Atom + robots.txt AI-bot allow-rate + openapi.json + webmanifest + .well-known/agents.t...
Paid CSP report-uri/report-to endpoint probe — extracts report-uri + report-to from CSP header + Reporting-Endpoints header lookup, then POSTs a synthetic csp-report payload to each declared endpoint to verify reachabili...
Paid /.well-known/* inventory probe - enumerates 30 standard + proposed well-known paths (security.txt RFC 9116 + openid-configuration + webfinger + nodeinfo + agents.txt + llms.txt + llms-full.txt + apple-app-site-assoc...
Paid agent cost calculator — detects auth scheme (Bearer/ApiKey/session_cookie/none) + rate-limit headers + CORS policy + cache max-age + compression + paid-API indicators (Stripe/Gumroad/pricing/checkout); returns estim...
Paid DNT/GPC policy probe (cycle 96) — fetches target URL 3x (baseline, with DNT:1, with Sec-GPC:1); compares Set-Cookie count + body size to detect server-side honoring of privacy signals; probes 5 common privacy-policy...
Paid Client Hints + Permissions-Policy probe (cycle 97) — captures Accept-CH (RFC 7231 §5.3.7) + Critical-CH (RFC 9981) request lines for Server Hints, parses Permissions-Policy header for feature gating intent; per-hint...
Paid full HTTP response header inventory (cycle 99) — DUMPS every response header and classifies each into 5 categories (security / caching / cors / content-negotiation / custom-vendor-prefixed); reports legacy_disclosur...
Paid RFC822 email-header forensics (cycle 101) — POST text/plain raw email source OR pass ?header=<RFC822> (256KB cap); folds continuation lines, parses per-Received hop (from/by/with-protocol/id/for-address/ips/delay/ti...
Paid CSP violation-report ROUND-TRIP replay (cycle 170, x402 $0.001) - fetches target page; extracts CSP header + meta CSP + Reporting-Endpoints header + report-uri + report-to group; for each declared endpoint REPLAYS 4...