Mmpp.ninja safe scan

Service record

Fantastic Jobs

https://mpp.orthogonal.com/fantastic-jobs
activedata

High-volume job postings feed. Indexes new ATS jobs hourly from 54 ATS platforms across 200k+ companies, plus job board listings from LinkedIn, Wellfound, and Y Combinator. Includes 20+ AI enrichments per job and deep

Implementation fingerprint
unknown no confident attribution
Fingerprint evidence
No implementation-specific public signal observed.
First seen
Aug 25, 2026, 6:43 PM UTC
Last seen
Oct 9, 2026, 6:24 PM UTC
Origin
https://mpp.orthogonal.com
Tags
jobsatshiringfeed

Payment surface

7 MPP endpoints

This count includes endpoints established by catalog, OpenAPI, or valid runtime 402 evidence. It does not count every URL the harmless scanner attempted.

JSON record →
GET
https://mpp.orthogonal.com/fantastic-jobs/v1/active-ats
Returns new jobs from 54 ATS platforms (company career pages). Refreshed hourly. Supports 30+ filters including title, location, source, AI experience level, work arrangement, and more. Pagination billing: call the first page normally and save billing.requestId from the Orthogonal /v1/run response. For later page, offset, or cursor calls on the same logical search, pass parentRequestId with unchanged non-pagination parameters. Valid continuation calls still get their own request IDs and quoted price, but are charged 0. Changing filters starts a new billable request.
Status: 400TLS: tested-passRedirects: 0Challenge: not observedLast probe: Oct 9, 06:24 PM UTC
mppchargeopenapiamount unknown USDC.e
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · rail
tempo
Session · url
https://mpp.orthogonal.com/fantastic-jobs/v1/active-ats
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
mppchargeopenapiamount unknown OUSD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · rail
tempo
Session · url
https://mpp.orthogonal.com/fantastic-jobs/v1/active-ats
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
x402chargeopenapiamount unknown USDC
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · rail
base
Session · url
https://x402.orthogonal.com/fantastic-jobs/v1/active-ats
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
x402chargeopenapiamount unknown OUSD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · rail
base
Session · url
https://x402.orthogonal.com/fantastic-jobs/v1/active-ats
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
x402chargeopenapiamount unknown USDC
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · rail
monad
Session · url
https://x402.orthogonal.com/fantastic-jobs/v1/active-ats
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
npchargeopenapiamount unknown USDC
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · rail
base
Session · settlement
circle-gateway
Session · version
x402-v2
Session · url
https://np.orthogonal.com/fantastic-jobs/v1/active-ats
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://mpp.orthogonal.com/fantastic-jobs/v1/active-jb
Returns new jobs from LinkedIn, Wellfound, and Y Combinator. LinkedIn hourly for English-speaking countries; others every few hours. Pagination billing: call the first page normally and save billing.requestId from the Orthogonal /v1/run response. For later page, offset, or cursor calls on the same logical search, pass parentRequestId with unchanged non-pagination parameters. Valid continuation calls still get their own request IDs and quoted price, but are charged 0. Changing filters starts a new billable request.
Status: 400TLS: tested-passRedirects: 0Challenge: not observedLast probe: Oct 1, 06:20 AM UTC
mppchargeopenapiamount unknown USDC.e
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · rail
tempo
Session · url
https://mpp.orthogonal.com/fantastic-jobs/v1/active-jb
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
mppchargeopenapiamount unknown OUSD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · rail
tempo
Session · url
https://mpp.orthogonal.com/fantastic-jobs/v1/active-jb
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
x402chargeopenapiamount unknown USDC
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · rail
base
Session · url
https://x402.orthogonal.com/fantastic-jobs/v1/active-jb
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
x402chargeopenapiamount unknown OUSD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · rail
base
Session · url
https://x402.orthogonal.com/fantastic-jobs/v1/active-jb
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
x402chargeopenapiamount unknown USDC
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · rail
monad
Session · url
https://x402.orthogonal.com/fantastic-jobs/v1/active-jb
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
npchargeopenapiamount unknown USDC
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · rail
base
Session · settlement
circle-gateway
Session · version
x402-v2
Session · url
https://np.orthogonal.com/fantastic-jobs/v1/active-jb
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://mpp.orthogonal.com/v1/active-ats
Returns new jobs from 54 ATS platforms (company career pages). Refreshed hourly. Supports 30+ filters including title
Status: 404TLS: tested-passRedirects: 0Challenge: not observedLast probe: Oct 8, 12:20 PM UTC
tempochargecatalog10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
request
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://mpp.orthogonal.com/v1/active-jb
Returns new jobs from LinkedIn, Wellfound, and Y Combinator. LinkedIn hourly for English-speaking countries; others
Status: 404TLS: tested-passRedirects: 0Challenge: not observedLast probe: Oct 8, 06:25 PM UTC
tempochargecatalog10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
request
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://mpp.orthogonal.com/v1/ats-organizations
Catalog of every organization tracked across ATS sources. ~50MB payload, refreshed daily at 02:00 UTC.
Status: 404TLS: tested-passRedirects: 0Challenge: not observedLast probe: Oct 8, 06:25 PM UTC
tempochargecatalog10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
request
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://mpp.orthogonal.com/v1/ats-organizations-advanced
Deep company profiles: LinkedIn, Crunchbase funding, Glassdoor ratings, headcount/revenue timeseries, news. Refreshed
Status: 404TLS: tested-passRedirects: 0Challenge: not observedLast probe: Oct 8, 06:18 AM UTC
tempochargecatalog10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
request
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://mpp.orthogonal.com/v1/modified-ats
ATS jobs whose fields changed in the last 24 hours. Returns full job data plus date_modified and modified_fields
Status: 404TLS: tested-passRedirects: 0Challenge: not observedLast probe: Oct 8, 06:20 PM UTC
tempochargecatalog10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
request
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.

Probe coverage

34 harmless observations

These are bounded unauthenticated requests and scanner-policy stops. A response without MPP evidence remains a discovery result, not a security failure.

GET https://mpp.orthogonal.com/fantastic-jobs/v1/active-ats

HTTP 400

3,587 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:24 PM UTC

GET https://mpp.orthogonal.com/fantastic-jobs/openapi.json

HTTP 200

4,118 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:23 PM UTC

GET https://mpp.orthogonal.com/v1/active-jb

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 8, 2026, 6:25 PM UTC

GET https://mpp.orthogonal.com/v1/ats-organizations

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 8, 2026, 6:25 PM UTC

GET https://mpp.orthogonal.com/v1/modified-ats

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 8, 2026, 6:20 PM UTC

GET https://mpp.orthogonal.com/v1/active-ats

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 8, 2026, 12:20 PM UTC

GET https://mpp.orthogonal.com/v1/ats-organizations-advanced

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 8, 2026, 6:18 AM UTC

GET https://mpp.orthogonal.com/fantastic-jobs/v1/active-jb

HTTP 400

2,731 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 1, 2026, 6:20 AM UTC

GET https://mpp.orthogonal.com/fantastic-jobs/v1/active-ats

HTTP 400

3,587 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 1, 2026, 12:22 AM UTC

GET https://mpp.orthogonal.com/fantastic-jobs/openapi.json

HTTP 200

3,590 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 30, 2026, 12:22 PM UTC

GET https://mpp.orthogonal.com/.well-known/api-catalog

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 29, 2026, 6:24 PM UTC

GET https://mpp.orthogonal.com/v1/active-jb

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 29, 2026, 12:21 PM UTC

GET https://mpp.orthogonal.com/v1/ats-organizations

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 29, 2026, 12:20 PM UTC

GET https://mpp.orthogonal.com/v1/modified-ats

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 29, 2026, 12:19 PM UTC

GET https://mpp.orthogonal.com/v1/active-ats

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 29, 2026, 6:19 AM UTC

GET https://mpp.orthogonal.com/v1/ats-organizations-advanced

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 29, 2026, 12:18 AM UTC

GET https://mpp.orthogonal.com/fantastic-jobs/v1/active-jb

HTTP 400

2,731 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 22, 2026, 12:20 AM UTC

GET https://mpp.orthogonal.com/fantastic-jobs/v1/active-ats

HTTP 400

3,587 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 21, 2026, 6:24 PM UTC

GET https://mpp.orthogonal.com/fantastic-jobs/openapi.json

HTTP 200

3,590 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 21, 2026, 6:24 AM UTC

GET https://mpp.orthogonal.com/.well-known/api-catalog

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 20, 2026, 12:25 PM UTC

GET https://mpp.orthogonal.com/v1/active-jb

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 20, 2026, 6:23 AM UTC

GET https://mpp.orthogonal.com/v1/ats-organizations

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 20, 2026, 6:21 AM UTC

GET https://mpp.orthogonal.com/v1/modified-ats

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 20, 2026, 6:20 AM UTC

GET https://mpp.orthogonal.com/v1/active-ats

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 20, 2026, 12:19 AM UTC

GET https://mpp.orthogonal.com/v1/ats-organizations-advanced

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 19, 2026, 6:20 PM UTC

GET https://mpp.orthogonal.com/fantastic-jobs/v1/active-jb

HTTP 400

2,731 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 12, 2026, 6:24 PM UTC

GET https://mpp.orthogonal.com/fantastic-jobs/v1/active-ats

HTTP 400

3,587 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 12, 2026, 6:22 PM UTC

GET https://mpp.orthogonal.com/fantastic-jobs/openapi.json

HTTP 200

3,590 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 12, 2026, 6:22 AM UTC

GET https://mpp.orthogonal.com/.well-known/api-catalog

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 11, 2026, 12:24 PM UTC

GET https://mpp.orthogonal.com/v1/active-jb

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 11, 2026, 6:22 AM UTC

GET https://mpp.orthogonal.com/v1/ats-organizations

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 11, 2026, 6:20 AM UTC

GET https://mpp.orthogonal.com/v1/modified-ats

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 11, 2026, 6:19 AM UTC

GET https://mpp.orthogonal.com/v1/active-ats

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 11, 2026, 12:23 AM UTC

GET https://mpp.orthogonal.com/v1/ats-organizations-advanced

HTTP 404

79 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Sep 10, 2026, 6:23 PM UTC

Evidence model

Security properties

Every result names its evidence state. Unknown and not tested never mean secure.

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:24 PM UTC

bounded_response

Tested — pass

3587 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:24 PM UTC

challenge_parse

Unknown

No MPP Payment challenge observed

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:24 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:24 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:24 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:24 PM UTC

economic_exposure_metadata

Unknown

No current Payment challenge exposes session or authorization inputs

Basis: observable challenge values only · Oct 9, 2026, 6:24 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:24 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:24 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:24 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:24 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:24 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:24 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:24 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 12:23 PM UTC

bounded_response

Tested — pass

4118 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 12:23 PM UTC

challenge_parse

Unknown

No MPP Payment challenge observed

Basis: unauthenticated HTTP response · Oct 9, 2026, 12:23 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:23 PM UTC

economic_exposure_metadata

Unknown

No current Payment challenge exposes session or authorization inputs

Basis: observable challenge values only · Oct 9, 2026, 12:23 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 12:23 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

openapi_parse

Tested — pass

12 payment offer(s) accepted

Basis: harmless discovery response · Oct 9, 2026, 12:23 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 12:23 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:23 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 12:23 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 8, 2026, 6:25 PM UTC

bounded_response

Tested — pass

79 bytes within scanner limit

Basis: harmless scanner · Oct 8, 2026, 6:25 PM UTC

challenge_parse

Unknown

No MPP Payment challenge observed

Basis: unauthenticated HTTP response · Oct 8, 2026, 6:25 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 8, 2026, 6:25 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 8, 2026, 6:25 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 8, 2026, 6:25 PM UTC

economic_exposure_metadata

Unknown

No current Payment challenge exposes session or authorization inputs

Basis: observable challenge values only · Oct 8, 2026, 6:25 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 8, 2026, 6:25 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 8, 2026, 6:25 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 8, 2026, 6:25 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 8, 2026, 6:25 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 8, 2026, 6:25 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 8, 2026, 6:25 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 8, 2026, 6:25 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 8, 2026, 6:25 PM UTC

bounded_response

Tested — pass

79 bytes within scanner limit

Basis: harmless scanner · Oct 8, 2026, 6:25 PM UTC

challenge_parse

Unknown

No MPP Payment challenge observed

Basis: unauthenticated HTTP response · Oct 8, 2026, 6:25 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 8, 2026, 6:25 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 8, 2026, 6:25 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 8, 2026, 6:25 PM UTC

economic_exposure_metadata

Unknown

No current Payment challenge exposes session or authorization inputs

Basis: observable challenge values only · Oct 8, 2026, 6:25 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 8, 2026, 6:25 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 8, 2026, 6:25 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 8, 2026, 6:25 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 8, 2026, 6:25 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 8, 2026, 6:25 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 8, 2026, 6:25 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 8, 2026, 6:25 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 8, 2026, 6:20 PM UTC

bounded_response

Tested — pass

79 bytes within scanner limit

Basis: harmless scanner · Oct 8, 2026, 6:20 PM UTC

challenge_parse

Unknown

No MPP Payment challenge observed

Basis: unauthenticated HTTP response · Oct 8, 2026, 6:20 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 8, 2026, 6:20 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 8, 2026, 6:20 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 8, 2026, 6:20 PM UTC

economic_exposure_metadata

Unknown

No current Payment challenge exposes session or authorization inputs

Basis: observable challenge values only · Oct 8, 2026, 6:20 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 8, 2026, 6:20 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 8, 2026, 6:20 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 8, 2026, 6:20 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 8, 2026, 6:20 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 8, 2026, 6:20 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 8, 2026, 6:20 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 8, 2026, 6:20 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 8, 2026, 12:20 PM UTC

bounded_response

Tested — pass

79 bytes within scanner limit

Basis: harmless scanner · Oct 8, 2026, 12:20 PM UTC

challenge_parse

Unknown

No MPP Payment challenge observed

Basis: unauthenticated HTTP response · Oct 8, 2026, 12:20 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 8, 2026, 12:20 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 8, 2026, 12:20 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 8, 2026, 12:20 PM UTC

economic_exposure_metadata

Unknown

No current Payment challenge exposes session or authorization inputs

Basis: observable challenge values only · Oct 8, 2026, 12:20 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 8, 2026, 12:20 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 8, 2026, 12:20 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 8, 2026, 12:20 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 8, 2026, 12:20 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 8, 2026, 12:20 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 8, 2026, 12:20 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 8, 2026, 12:20 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 8, 2026, 6:18 AM UTC

bounded_response

Tested — pass

79 bytes within scanner limit

Basis: harmless scanner · Oct 8, 2026, 6:18 AM UTC

challenge_parse

Unknown

No MPP Payment challenge observed

Basis: unauthenticated HTTP response · Oct 8, 2026, 6:18 AM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 8, 2026, 6:18 AM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 8, 2026, 6:18 AM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 8, 2026, 6:18 AM UTC

economic_exposure_metadata

Unknown

No current Payment challenge exposes session or authorization inputs

Basis: observable challenge values only · Oct 8, 2026, 6:18 AM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 8, 2026, 6:18 AM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 8, 2026, 6:18 AM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 8, 2026, 6:18 AM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 8, 2026, 6:18 AM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 8, 2026, 6:18 AM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 8, 2026, 6:18 AM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 8, 2026, 6:18 AM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 1, 2026, 6:20 AM UTC

bounded_response

Tested — pass

2731 bytes within scanner limit

Basis: harmless scanner · Oct 1, 2026, 6:20 AM UTC

challenge_parse

Unknown

No MPP Payment challenge observed

Basis: unauthenticated HTTP response · Oct 1, 2026, 6:20 AM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 1, 2026, 6:20 AM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 1, 2026, 6:20 AM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 1, 2026, 6:20 AM UTC

economic_exposure_metadata

Unknown

No current Payment challenge exposes session or authorization inputs

Basis: observable challenge values only · Oct 1, 2026, 6:20 AM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 1, 2026, 6:20 AM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 1, 2026, 6:20 AM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 1, 2026, 6:20 AM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 1, 2026, 6:20 AM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 1, 2026, 6:20 AM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 1, 2026, 6:20 AM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 1, 2026, 6:20 AM UTC

api_catalog_parse

Observed

No RFC 9727 API catalog was available at this URL (HTTP 404); prior advertised links were withdrawn

Basis: RFC 9727 discovery response · Sep 29, 2026, 6:24 PM UTC

History

Service changes

Showing the latest 50 of 82 changes. Continue in the changes API view.

— payment-offer-updated

session_json: {"rail":"base","url":"https://x402.orthogonal.com/fantastic-jobs/v1/active-ats"} → {"rail":"tempo","url":"https://mpp.orthogonal.com/fantastic-jobs/v1/active-ats"}

Evidence: openapi payment metadata

— payment-offer-updated

session_json: {"rail":"monad","url":"https://x402.orthogonal.com/fantastic-jobs/v1/active-ats"} → {"rail":"base","url":"https://x402.orthogonal.com/fantastic-jobs/v1/active-ats"}

Evidence: openapi payment metadata

— payment-offer-updated

session_json: {"rail":"base","url":"https://x402.orthogonal.com/fantastic-jobs/v1/active-jb"} → {"rail":"tempo","url":"https://mpp.orthogonal.com/fantastic-jobs/v1/active-jb"}

Evidence: openapi payment metadata

— payment-offer-updated

session_json: {"rail":"base","settlement":"circle-gateway","version":"x402-v2","url":"https://np.orthogonal.com/fantastic-jobs/v1/act… → {"rail":"base","url":"https://x402.orthogonal.com/fantastic-jobs/v1/active-ats"}

Evidence: openapi payment metadata

— payment-offer-updated

session_json: {"rail":"monad","url":"https://x402.orthogonal.com/fantastic-jobs/v1/active-jb"} → {"rail":"base","url":"https://x402.orthogonal.com/fantastic-jobs/v1/active-jb"}

Evidence: openapi payment metadata

— payment-offer-updated

currency: USDC → OUSD

Evidence: openapi payment metadata

— payment-offer-updated

method: x402 → mpp

Evidence: openapi payment metadata

— payment-offer-updated

currency: USDC → OUSD

Evidence: openapi payment metadata

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"3590 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"4118 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— payment-offer-discovered

offer → {"method":"np","intent":"charge","currency":"USDC","chainId":null,"recipient":null,"amount":null,"decimals":null,"unitT…

Evidence: openapi payment metadata

— payment-offer-updated

currency: USDC → OUSD

Evidence: openapi payment metadata

— payment-offer-updated

method: np → x402

Evidence: openapi payment metadata

— security-property-changed

security:openapi_parse: {"state":"tested-pass","evidence":"8 payment offer(s) accepted","basis":"harmless discovery response"} → {"state":"tested-pass","evidence":"12 payment offer(s) accepted","basis":"harmless discovery response"}

Evidence: Repeated harmless observation changed the modeled property

— payment-offer-discovered

offer → {"method":"x402","intent":"charge","currency":"USDC","chainId":null,"recipient":null,"amount":null,"decimals":null,"uni…

Evidence: openapi payment metadata

— payment-offer-updated

method: np → x402

Evidence: openapi payment metadata

— payment-offer-discovered

offer → {"method":"x402","intent":"charge","currency":"USDC","chainId":null,"recipient":null,"amount":null,"decimals":null,"uni…

Evidence: openapi payment metadata

— payment-offer-updated

currency: USDC → OUSD

Evidence: openapi payment metadata

— payment-offer-updated

session_json: {"rail":"base","settlement":"circle-gateway","version":"x402-v2","url":"https://np.orthogonal.com/fantastic-jobs/v1/act… → {"rail":"base","url":"https://x402.orthogonal.com/fantastic-jobs/v1/active-jb"}

Evidence: openapi payment metadata

— payment-offer-discovered

offer → {"method":"np","intent":"charge","currency":"USDC","chainId":null,"recipient":null,"amount":null,"decimals":null,"unitT…

Evidence: openapi payment metadata

— payment-offer-updated

method: x402 → mpp

Evidence: openapi payment metadata

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"79 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"3590 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"3578 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"79 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"79 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"3578 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:api_catalog_parse: {"state":"observed","evidence":"API catalog source returned HTTP 404; prior advertised links were withdrawn","basis":"R… → {"state":"observed","evidence":"No RFC 9727 API catalog was available at this URL (HTTP 404); prior advertised links we…

Evidence: Repeated harmless observation changed the modeled property

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"3578 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"79 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property