Mmpp.ninja safe scan

Service record

StableTravel

https://stabletravel.dev/
activedataweb

Flight prices and booking links, award availability, and real-time flight tracking. Powered by Google Flights, Seats.aero, and FlightAware.

Implementation fingerprint
custom 35% confidence
Fingerprint evidence
valid 402 Payment challenge observed without implementation-specific marker
First seen
Aug 25, 2026, 6:43 PM UTC
Last seen
Oct 9, 2026, 6:25 PM UTC
Origin
https://stabletravel.dev
Tags
flightawareflightsgoogle-flightsseats-aerotravel

Payment surface

78 MPP endpoints

This count includes endpoints established by catalog, OpenAPI, or valid runtime 402 evidence. It does not count every URL the harmless scanner attempted.

This bounded detail view shows 25 endpoints. Continue with the next API page or the endpoint index.

JSON record →
GET
https://stabletravel.dev/api/flightaware/airports
List all airports
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 3, 06:19 AM UTC
tempochargecatalog10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.010000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.010000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id
Get airport info by code
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 12:19 PM UTC
tempochargecatalog30000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge30000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id/canonical
Get canonical airport code
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 06:21 PM UTC
tempochargecatalog2000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge2000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id/delays
Get delays for a specific airport
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 06:21 PM UTC
tempochargecatalog20000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge20000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id/flights
Get all flights at an airport
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 06:22 PM UTC
tempochargecatalog40000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge40000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id/flights/arrivals
Get arrivals at an airport
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 06:25 PM UTC
tempochargecatalog10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id/flights/counts
Get flight count statistics
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 12:23 PM UTC
tempochargecatalog200000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge200000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id/flights/departures
Get departures from an airport
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 1, 12:22 AM UTC
tempochargecatalog10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id/flights/scheduled-arrivals
Get scheduled arrivals
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 1, 12:23 AM UTC
tempochargecatalog10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id/flights/scheduled-departures
Get scheduled departures
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 12:20 PM UTC
tempochargecatalog10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id/flights/to/:dest_id
Get flights between two airports
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 06:25 PM UTC
tempochargecatalog100000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge100000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id/nearby
Find airports near a specific airport
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 06:23 PM UTC
tempochargecatalog8000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge8000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id/routes/:dest_id
Get route info between airports
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 1, 12:23 AM UTC
tempochargecatalog40000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge40000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id/weather/forecast
Get TAF weather forecast
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 9, 12:21 PM UTC
tempochargecatalog4000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge4000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/:id/weather/observations
Get METAR weather observations
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 1, 12:24 AM UTC
tempochargecatalog4000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge4000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/delays
Get all airport delay information
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 4, 06:22 PM UTC
tempochargecatalog100000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
not observed
Chain
not observed
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
tempochargechallenge100000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.100000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.100000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/id
Get detailed information for a specific airport by its code
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 3, 06:19 AM UTC
tempochargechallenge30000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.030000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.030000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/id/canonical
Get the canonical airport code for a given airport identifier
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 3, 12:26 PM UTC
tempochargechallenge2000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.002000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.002000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/id/delays
Get current delay information for a specific airport
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 3, 06:21 AM UTC
tempochargechallenge20000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.020000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.020000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/id/flights
Get all flights (arrivals, departures, enroute, scheduled) for an airport
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 4, 06:23 AM UTC
tempochargechallenge40000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.040000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.040000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/id/flights/arrivals
Get arrival flights for a specific airport
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 2, 12:34 PM UTC
tempochargechallenge10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.010000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.010000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/id/flights/counts
Get flight counts (departed, enroute, scheduled) for a specific airport
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 4, 06:22 PM UTC
tempochargechallenge200000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.200000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.200000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/id/flights/departures
Get departure flights for a specific airport
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 5, 12:21 AM UTC
tempochargechallenge10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.010000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.010000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/id/flights/scheduled-arrivals
Get scheduled arrival flights for a specific airport
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 4, 12:24 PM UTC
tempochargechallenge10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.010000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.010000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
GET
https://stabletravel.dev/api/flightaware/airports/id/flights/scheduled-departures
Get scheduled departure flights for a specific airport
Status: 402TLS: tested-passRedirects: 0Challenge: mpp-payment-authLast probe: Oct 3, 06:18 AM UTC
tempochargechallenge10000 0x20c000000000000000000000b9537d11c60e8b50
Recipient
0xDd257723b86B4947483905cdAcBbBC70fACF2ec0
Chain
4217
Unit type
not observed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.010000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.
unknownchargeopenapi0.010000 USD
Recipient
not observed
Chain
not observed
Unit type
not observed
Session · mode
fixed
Economic exposure: unknown — the public observation does not contain enough session or authorization inputs to calculate it.

Probe coverage

317 harmless observations

These are bounded unauthenticated requests and scanner-policy stops. A response without MPP evidence remains a discovery result, not a security failure.

GET https://stabletravel.dev/api/flightaware/flights/:id/route-info

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:25 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/:id/flights/arrivals

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:25 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/:id/flights/to/:dest_id

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:25 PM UTC

GET https://stabletravel.dev/api/flightaware/disruption-counts/:entity_type

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:25 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/:id/nearby

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:23 PM UTC

GET https://stabletravel.dev/

HTTP 200

48,198 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:23 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/:id/flights

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:22 PM UTC

GET https://stabletravel.dev/api/flightaware/history/airports/:id/flights/arrivals

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:22 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/:id/delays

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:21 PM UTC

GET https://stabletravel.dev/api/flightaware/history/operators/:id/flights

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:21 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/:id/canonical

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:21 PM UTC

GET https://stabletravel.dev/api/flightaware/flights/:id

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:21 PM UTC

GET https://stabletravel.dev/api/flightaware/flights/:id/position

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:20 PM UTC

GET https://stabletravel.dev/api/flightaware/history/flights/:id

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:24 PM UTC

GET https://stabletravel.dev/api/flightaware/history/airports/:id/flights/departures

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:24 PM UTC

GET https://stabletravel.dev/api/flightaware/history/aircraft/:registration/last-flight

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:23 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/:id/flights/counts

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:23 PM UTC

GET https://stabletravel.dev/api/flightaware/history/flights/:id/track

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:21 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/:id/weather/forecast

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:21 PM UTC

GET https://stabletravel.dev/api/flightaware/history/flights/:id/map

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:20 PM UTC

GET https://stabletravel.dev/api/flightaware/history/airports/:id/flights/to/:dest_id

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:20 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/:id/flights/scheduled-departures

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:20 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/:id

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 12:19 PM UTC

GET https://stabletravel.dev/api/flightaware/history/flights/:id/route-info

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:18 AM UTC

GET https://stabletravel.dev/api/flightaware/flights/:id/map

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:18 AM UTC

GET https://stabletravel.dev/api/flightaware/disruption-counts/:entity_type/:id

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:18 AM UTC

GET https://stabletravel.dev/api/flightaware/flights/:id/track

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:18 AM UTC

GET https://stabletravel.dev/api/flightaware/flights/:id/canonical

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 9, 2026, 6:18 AM UTC

GET https://stabletravel.dev/api/flightaware/history/flights/id

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 5, 2026, 12:23 AM UTC

GET https://stabletravel.dev/api/flightaware/airports/id/flights/departures

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 5, 2026, 12:21 AM UTC

GET https://stabletravel.dev/api/seats-aero/search

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 6:23 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/delays

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 6:22 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/id/flights/counts

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 6:22 PM UTC

GET https://stabletravel.dev/api/flightaware/history/aircraft/registration/last-flight

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 6:21 PM UTC

GET https://stabletravel.dev/api/flightaware/history/airports/id/flights/to/dest_id

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 12:26 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/id/flights/scheduled-arrivals

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 12:24 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/id/weather/forecast

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 12:21 PM UTC

GET https://stabletravel.dev/api/flightaware/flights/id/route-info

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 12:19 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/id/routes/dest_id

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 6:24 AM UTC

GET https://stabletravel.dev/api/flightaware/airports/id/flights

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 6:23 AM UTC

GET https://stabletravel.dev/api/flightaware/flights/id/track

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 6:21 AM UTC

GET https://stabletravel.dev/api/flightaware/flights/id/position

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 12:23 AM UTC

GET https://stabletravel.dev/api/seats-aero/trips/id

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 12:23 AM UTC

GET https://stabletravel.dev/api/seats-aero/routes

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 12:22 AM UTC

GET https://stabletravel.dev/api/flightaware/flights/search/advanced

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 4, 2026, 12:19 AM UTC

GET https://stabletravel.dev/api/flightaware/flights/search

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 3, 2026, 6:24 PM UTC

GET https://stabletravel.dev/api/flightaware/airports/id/canonical

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 3, 2026, 12:26 PM UTC

GET https://stabletravel.dev/api/flightaware/flights/search/count

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 3, 2026, 12:25 PM UTC

GET https://stabletravel.dev/api/google-flights/search

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 3, 2026, 12:24 PM UTC

GET https://stabletravel.dev/api/flightaware/history/flights/id/track

HTTP 402

0 response bytes · 0 redirects · HTTPS fetch completed with platform certificate validation

Oct 3, 2026, 12:21 PM UTC
Showing the latest 50 of 317 observations.

Evidence model

Security properties

Every result names its evidence state. Unknown and not tested never mean secure.

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:25 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:25 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:25 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:25 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:25 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:25 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:25 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:25 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:25 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:25 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:25 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:25 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:25 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:25 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:25 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:25 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:25 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:25 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:25 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:25 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:25 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:25 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:25 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:25 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:25 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:25 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:25 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:25 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:25 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:25 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:25 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:25 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:25 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:25 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:25 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:25 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:25 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:23 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:23 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:23 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:23 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:23 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:23 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:23 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:23 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:23 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:23 PM UTC

bounded_response

Tested — pass

48198 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:23 PM UTC

challenge_parse

Unknown

No MPP Payment challenge observed

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:23 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:23 PM UTC

economic_exposure_metadata

Unknown

No current Payment challenge exposes session or authorization inputs

Basis: observable challenge values only · Oct 9, 2026, 6:23 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:23 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:23 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:23 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:23 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:23 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:22 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:22 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:22 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:22 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:22 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:22 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:22 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:22 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:22 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:22 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:22 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:22 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:22 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:22 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:22 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:22 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:22 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:22 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:22 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:21 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:21 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:21 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:21 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:21 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:21 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:21 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:21 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:21 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:21 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:21 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:21 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:21 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:21 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:21 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:21 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:21 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:21 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:21 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:21 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:21 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:21 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:21 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:21 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:21 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:21 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:21 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:21 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:21 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:21 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:21 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:21 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:21 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:21 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:21 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:21 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:21 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 6:20 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 6:20 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 6:20 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 6:20 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 6:20 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:20 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 6:20 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 6:20 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 6:20 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 6:20 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 6:20 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 6:20 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 6:20 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 6:20 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 12:24 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 12:24 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 12:24 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 12:24 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 12:24 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:24 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 12:24 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 12:24 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 12:24 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 12:24 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 12:24 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 12:24 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:24 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 12:24 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 12:24 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 12:24 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 12:24 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 12:24 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 12:24 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:24 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 12:24 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 12:24 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 12:24 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 12:24 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 12:24 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 12:24 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:24 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 12:24 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 12:23 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 12:23 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 12:23 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:23 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 12:23 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 12:23 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 12:23 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:23 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 12:23 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 12:23 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 12:23 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 12:23 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:23 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 12:23 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 12:23 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 12:23 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 12:23 PM UTC

replay_idempotency_scope

Not tested

Scanner never replays signed credentials

Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:23 PM UTC

ssrf_target_validation

Tested — pass

1 hop(s) resolved twice to stable public addresses

Basis: scanner URL, DNS and redirect policy · Oct 9, 2026, 12:23 PM UTC

authorization_delivery_settlement

Not tested

Requires paid or state-changing behavior outside scanner scope

Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Oct 9, 2026, 12:21 PM UTC

bounded_response

Tested — pass

0 bytes within scanner limit

Basis: harmless scanner · Oct 9, 2026, 12:21 PM UTC

challenge_parse

Tested — pass

1 Payment challenge(s) observed on HTTP 402; all required fields decoded and validated

Basis: unauthenticated HTTP response · Oct 9, 2026, 12:21 PM UTC

channel_lifecycle_binding

Not tested

Channel and settlement lifecycle require credentials or payments

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

concurrency_single_winner

Not tested

Concurrency and paid state changes are prohibited

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

credential_replay

Not tested

Scanner never sends credentials or payments

Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Oct 9, 2026, 12:21 PM UTC

economic_exposure_metadata

Unknown

[{"method":"tempo","intent":"charge","deposit":null,"authorizationWindow":null,"depositWindowRatio":null,"observableAuthorizationExposure":null,"note":"unknown: session authorization inputs not observable"}]

Basis: observable challenge values only · Oct 9, 2026, 12:21 PM UTC

fee_payer_cosigner_binding

Not tested

Signature and fee-payer relationships are not observable unauthenticated

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

https_transport

Tested — pass

HTTPS fetch completed with platform certificate validation

Basis: platform TLS validation · Oct 9, 2026, 12:21 PM UTC

method_fallback_policy

Not tested

Scanner does not select, downgrade, or execute payment methods

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

price_debit_consistency

Not tested

Requires a completed paid interaction outside scanner scope

Basis: public economic-security prior art · Oct 9, 2026, 12:21 PM UTC

redirect_policy

Tested — pass

0 redirects; every hop passed URL and DNS validation

Basis: harmless scanner · Oct 9, 2026, 12:21 PM UTC
Showing a bounded 250 of 1,346 security-property records.

History

Service changes

Showing the latest 50 of 1,234 changes. Continue in the changes API view.

— security-property-changed

security:bounded_response: {"state":"tested-pass","evidence":"146605 bytes within scanner limit","basis":"harmless scanner"} → {"state":"tested-pass","evidence":"12346 bytes within scanner limit","basis":"harmless scanner"}

Evidence: Repeated harmless observation changed the modeled property

— probe-observation

redirect_count → 0

Evidence: harmless unauthenticated HTTP observation

— payment-offer-discovered

offer → {"method":"tempo","intent":"charge","currency":"0x20c000000000000000000000b9537d11c60e8b50","chainId":"4217","recipient…

Evidence: challenge payment metadata

— probe-observation

last_status → 402

Evidence: harmless unauthenticated HTTP observation

— probe-observation

tls_state: not-tested → tested-pass

Evidence: harmless unauthenticated HTTP observation

— probe-observation

content_type → application/json

Evidence: harmless unauthenticated HTTP observation

— endpoint-source-discovered

source:challenge → active

Evidence: https://stabletravel.dev/api/seats-aero/trips/:id

— probe-observation

challenge_format → mpp-payment-auth

Evidence: harmless unauthenticated HTTP observation

— payment-offer-withdrawn

offer-active: 1 → 0

Evidence: catalog source https://mpp.dev/api/services

— payment-offer-withdrawn

offer-active: 1 → 0

Evidence: catalog source https://mpp.dev/api/services

— endpoint-source-withdrawn

source:catalog: 1 → 0

Evidence: https://mpp.dev/api/services

— payment-offer-discovered

offer → {"method":"tempo","intent":"charge","currency":"0x20c000000000000000000000b9537d11c60e8b50","chainId":null,"recipient":…

Evidence: catalog payment metadata

— payment-offer-withdrawn

offer-active: 1 → 0

Evidence: catalog source https://mpp.dev/api/services

— endpoint-source-withdrawn

source:catalog: 1 → 0

Evidence: https://mpp.dev/api/services

— payment-offer-withdrawn

offer-active: 1 → 0

Evidence: catalog source https://mpp.dev/api/services

— payment-offer-withdrawn

offer-active: 1 → 0

Evidence: catalog source https://mpp.dev/api/services

— endpoint-source-withdrawn

source:catalog: 1 → 0

Evidence: https://mpp.dev/api/services

— payment-offer-withdrawn

offer-active: 1 → 0

Evidence: catalog source https://mpp.dev/api/services

— endpoint-source-discovered

source:catalog → active

Evidence: https://mpp.dev/api/services

— endpoint-source-withdrawn

source:catalog: 1 → 0

Evidence: https://mpp.dev/api/services

— payment-offer-withdrawn

offer-active: 1 → 0

Evidence: catalog source https://mpp.dev/api/services

— endpoint-source-discovered

source:catalog → active

Evidence: https://mpp.dev/api/services

— endpoint-source-withdrawn

source:catalog: 1 → 0

Evidence: https://mpp.dev/api/services

— endpoint-source-withdrawn

source:catalog: 1 → 0

Evidence: https://mpp.dev/api/services

— payment-offer-withdrawn

offer-active: 1 → 0

Evidence: catalog source https://mpp.dev/api/services