1,157 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid heuristic email spam score for AI-agent triage (cycle 123, x402 $0.001) - accepts POST text/plain raw email source (RFC822 headers+body) or GET ?header=<url-encoded> or GET ?url=<.eml URL>; parses headers+body and c...
Paid BGP route-leak + prefix-hijack exposure probe (cycle 126, x402 $0.001) - resolves target host via Cloudflare DoH, queries RIPEstat prefix-overview for each IP, classifies announcing ASNs + holders, computes consensu...
Paid Permissions-Policy + Feature-Policy header audit (cycle 124, x402 $0.001) - fetches target URL + iterates ALL Permissions-Policy (modern) AND Feature-Policy (legacy) headers, parses 17 tracked features (camera/micro...
Paid dev-portal / VCS-dotfile / debug-surface exposure probe (cycle 127, x402 $0.001) - probes 39 conventional dev/debug/VCS-leak paths (/swagger-ui.html + /graphiql + /actuator + /.git/HEAD + /.env + /server-status + /p...
Paid CSP inline-fidelity validator (cycle 130, x402 $0.001) - fetches target URL, parses CSP, extracts every inline <script>/<style> block + event handler, computes sha256 of each, reports per-block {hash_in_csp, nonce_i...
Paid GraphQL introspection exposure audit (cycle 129, x402 $0.001) - accepts host OR url param, probes up to 6 conventional GraphQL endpoints (/graphql, /api/graphql, /v1/graphql, /query), sends canonical IntrospectionQu...
Paid HTTP request-smuggling CL.TE/TE.CL/TE.TE tolerance evidence probe (cycle 129, x402 $0.001) - opens low-level socket (bypasses urllib header normalization) to target host, sends 6 PortSwigger-style evidence requests...
Paid cookie partition consistency audit (cycle 130, x402 $0.001) - probes 6 conventional paths (apex/login/signup/api/cart/account), parses Set-Cookie from each, groups by cookie name across responses, flags inconsistenc...
Paid DANE/TLSA + SMTP STARTTLS active probe (cycle 137, x402 $0.001) - resolves MX for domain, looks up _25._tcp.<mxhost> + _587._tcp.<mxhost> + _465._tcp.<mxhost> TLSA records (RFC 6698/7672), opens SMTP socket to MX:25...
Paid rate-limit header surface + live burst probe (cycle 134, x402 $0.001) - fetches target 4x in a burst, parses 7 known rate-limit header families (IETF RFC 9239 draft, X-RateLimit-*, Twitter, Stripe, Shopify, GitHub,...
Paid SSL-pinning / HPKP policy probe (x402 $0.001) - GET ?domain=<DOMAIN> checks for deprecated HPKP (RFC 7469) headers, CSP public-key-pins directives and pinning-related security headers, returning a pinning posture gr...
Paid WebAssembly CSP + wasm-unsafe-eval coverage analyzer (cycle 137, x402 $0.001) - fetches target URL, scans for WASM indicators (inline WebAssembly.instantiate/compile + .wasm file references + <link rel=preload as=fe...
Paid Content Language detector (cycle 139, x402 $0.001) - fetches URL + extracts language declarations across html lang attribute + HTTP Content-Language header + og:locale/og:locale:alternate + hreflang link tags + meta...
Paid security-header mutation test (cycle 143, x402 $0.001) - fetches target URL 5x with deliberately different fingerprint headers (Chrome desktop + Firefox + Mobile Safari + python-requests bot + baseline); compares th...
Paid web-cache-poisoning + deception active probe (cycle 145, x402 $0.001) - 5 unkeyed-header probes (X-Forwarded-Host + X-Original-URL + X-Forwarded-Prefix + X-Host + X-Forwarded-Server + X-Forwarded-For + X-Forwarded-P...
Paid deep CORS preflight OPTIONS audit (cycle 145, x402 $0.001) - 6 sequenced CORS probes (baseline GET + simple-Origin preflight + post+contenttype+auth preflight + multi-header preflight x-custom-1/x-custom-2 + credent...
Paid CDN cache-key collision probe (cycle 139, x402 $0.001) - actively fetches target with 4 probe pairs (Accept-Language en-vs-es / Accept-Encoding gzip-vs-br / Cookie session vs no-session / User-Agent desktop-vs-mobil...
Paid HTTP/1.1 hop-by-hop header correctness probe (cycle 141, x402 $0.001) - opens raw TCP to host:443 + :80, sends 3 sequential GET requests with explicit Connection: keep-alive, X-Hop-Marker-A1b2c3, X-Internal-Trace-X9...
Paid Content-Encoding integrity + compression-bomb detector (cycle 141, x402 $0.001) - fetches URL 3x: no Accept-Encoding baseline + Accept-Encoding: gzip + Accept-Encoding: br, gzip; records raw bytes + Content-Length +...
Paid Set-Cookie × shared-cache disclosure scanner (cycle 148, x402 $0.001) — probes 8 sensitive paths on target origin (/login + /api/me + /api/session + /account + /profile + /dashboard + /me + /api/user, + optional ext...
Paid JWT algorithm-confusion + kid-injection + JWKS-header-hijack probe (cycle 153) - forges 12 forged-JWT attack classes (alg:none variants + kid-injection variants + jku/jwk/x5u attacker-controlled) and (when public_ke...
Paid CSP permissive-source budget scorer (cycle 154) - quantifies aggregate attack-surface allowed by the policy. Parses header + meta + report-only delivery mechanisms, classifies every source value as high (script-src...
Paid OWASP API Security Top 10 (2023) one-call composite audit (cycle 151, x402 $0.001) - fetches target URL + probes 24 conventional API paths in parallel via ThreadPoolExecutor, runs all 10 OWASP 2023 category checks:...
Paid CSP x Subresource-Integrity (SRI) verifier (cycle 150, x402 $0.001) - fetches URL HTML, extracts every external <script src=> + <link rel=stylesheet href=>, fetches each asset (200KB cap), computes sha256 + sha384,...