All projects matching “cors”

Sends a real request to any URL you provide, attaches an Origin header, and reads back all six standard cross-origin permission headers the server returns. Tells you whether cross-origin requests are enabled at all, whether your specific origin is permitted, and shows every permission value exactly as the server sent it. Useful for finding why a browser is blocking a request, confirming a new depl

No accidental wildcard CORS evidence record fetches current public evidence from the supplied target and evaluates the documented criterion. It returns the observation, threshold, verdict, exact evidence source, limitations and a mode-specific action. The check is passive: no login attempt, payload injection, exploit, purchase, form submission or load test is performed.

Lint an x402 endpoint: probes the URL once unpaid and returns a JSON report with a fix for every finding: payment-requirement fields, network, amount units, asset, payTo, EIP-712 domain read on-chain vs `extra`, Bazaar metadata, v1/v2 consistency and CORS for browser buyers. Free demo: GET /v1/check?url=

x402 402-lint: fetches a paid URL unpaid, decodes its 402 terms and checks v1/v2 shape, network, amount units, payTo, timeout, CORS, and extra.name/version against the token's on-chain EIP-712 domain.

HTTP endpoint health audit for one URL: status and redirect chain, latency p50/p95 over repeated samples, TLS certificate expiry and issuer, the response headers that matter, and a list of detected anomalies (missing HSTS/CSP/X-Content-Type-Options, expiring cert, weak TLS, CORS wildcard, insecure cookies, version disclosure, slow p95, redirect loops). Private, loopback and link-local targets are

Run a bounded deterministic preflight scan for possible private keys, secret assignments, permissive CORS, debug mode, insecure HTTP, and invalid JSON. Not a comprehensive security audit.