MPP-enabled content retrieval from Substack publications.
Payment surface
This count includes endpoints established by catalog, OpenAPI, or valid runtime 402 evidence. It does not count every URL the harmless scanner attempted.
Probe coverage
These are bounded unauthenticated requests and scanner-policy stops. A response without MPP evidence remains a discovery result, not a security failure.
Cross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 9, 2026, 12:36 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 9, 2026, 6:32 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 9, 2026, 12:37 AM UTCCross-host redirect to https://dripstack.com/openapi.json was recorded but not followed
Oct 9, 2026, 12:19 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 8, 2026, 6:39 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 8, 2026, 12:36 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 8, 2026, 6:36 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 8, 2026, 12:35 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 7, 2026, 6:36 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 7, 2026, 12:36 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 7, 2026, 6:38 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 7, 2026, 12:41 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 6, 2026, 6:39 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 6, 2026, 12:40 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 6, 2026, 6:32 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 6, 2026, 12:37 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 5, 2026, 6:36 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 5, 2026, 12:35 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 5, 2026, 6:34 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 5, 2026, 12:34 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 4, 2026, 6:33 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 4, 2026, 12:37 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 4, 2026, 6:35 AM UTCCross-host redirect to https://dripstack.com/.well-known/api-catalog was recorded but not followed
Oct 4, 2026, 6:22 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 4, 2026, 12:36 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 3, 2026, 6:35 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 3, 2026, 12:40 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 3, 2026, 6:32 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 3, 2026, 12:38 AM UTCCross-host redirect to https://dripstack.com/api/v1/publications/:publicationSlug/:postSlug was recorded but not followed
Oct 3, 2026, 12:31 AM UTCCross-host redirect to https://dripstack.com/api/v1/publications/:publicationSlug was recorded but not followed
Oct 3, 2026, 12:30 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 2, 2026, 6:36 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 2, 2026, 12:46 PM UTCCross-host redirect to https://dripstack.com/api/v1/publications was recorded but not followed
Oct 2, 2026, 12:21 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 2, 2026, 6:34 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 2, 2026, 12:35 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 1, 2026, 6:33 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 1, 2026, 12:38 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 1, 2026, 6:32 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Oct 1, 2026, 12:36 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Sep 30, 2026, 6:33 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Sep 30, 2026, 12:33 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Sep 30, 2026, 6:36 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Sep 30, 2026, 12:33 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Sep 29, 2026, 6:33 PM UTCCross-host redirect to https://dripstack.com/openapi.json was recorded but not followed
Sep 29, 2026, 6:20 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Sep 29, 2026, 12:32 PM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Sep 29, 2026, 6:32 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Sep 29, 2026, 12:33 AM UTCCross-host redirect to https://dripstack.com/ was recorded but not followed
Sep 28, 2026, 6:36 PM UTCEvidence model
Every result names its evidence state. Unknown and not tested never mean secure.
cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not followed
Basis: scanner policy decision · Oct 9, 2026, 12:36 PM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/publications/:publicationSlug/:postSlug was recorded but not followed
Basis: scanner policy decision · Oct 3, 2026, 12:31 AM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/publications/:publicationSlug was recorded but not followed
Basis: scanner policy decision · Oct 3, 2026, 12:30 AM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/publications was recorded but not followed
Basis: scanner policy decision · Oct 2, 2026, 12:21 PM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/companies was recorded but not followed
Basis: scanner policy decision · Sep 9, 2026, 12:24 AM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/me/credits/activity was recorded but not followed
Basis: scanner policy decision · Sep 8, 2026, 6:22 PM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/me/credits was recorded but not followed
Basis: scanner policy decision · Sep 8, 2026, 12:23 PM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/me was recorded but not followed
Basis: scanner policy decision · Sep 7, 2026, 6:25 PM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/publications/search was recorded but not followed
Basis: scanner policy decision · Sep 7, 2026, 6:24 AM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/me/unlocks was recorded but not followed
Basis: scanner policy decision · Sep 7, 2026, 6:22 AM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/entities/search was recorded but not followed
Basis: scanner policy decision · Sep 7, 2026, 6:21 AM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/search was recorded but not followed
Basis: scanner policy decision · Sep 7, 2026, 12:22 AM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/posts/top-selling was recorded but not followed
Basis: scanner policy decision · Sep 6, 2026, 12:21 PM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/publications/top-selling was recorded but not followed
Basis: scanner policy decision · Sep 6, 2026, 12:20 PM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/podcasts was recorded but not followed
Basis: scanner policy decision · Sep 6, 2026, 12:20 PM UTCcross-host-redirect: Cross-host redirect to https://dripstack.com/api/v1/stock-picks/quote was recorded but not followed
Basis: scanner policy decision · Sep 6, 2026, 12:19 PM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 31, 2026, 12:22 PM UTC133 bytes within scanner limit
Basis: harmless scanner · Aug 31, 2026, 12:22 PM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 31, 2026, 12:22 PM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 31, 2026, 12:22 PM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 31, 2026, 12:22 PM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 31, 2026, 12:22 PM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 31, 2026, 12:22 PM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 31, 2026, 12:22 PM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 31, 2026, 12:22 PM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 31, 2026, 12:22 PM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 31, 2026, 12:22 PM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 31, 2026, 12:22 PM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 31, 2026, 12:22 PM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 31, 2026, 12:22 PM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 31, 2026, 12:18 PM UTC120 bytes within scanner limit
Basis: harmless scanner · Aug 31, 2026, 12:18 PM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 31, 2026, 12:18 PM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 31, 2026, 12:18 PM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 31, 2026, 12:18 PM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 31, 2026, 12:18 PM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 31, 2026, 12:18 PM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 31, 2026, 12:18 PM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 31, 2026, 12:18 PM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 31, 2026, 12:18 PM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 31, 2026, 12:18 PM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 31, 2026, 12:18 PM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 31, 2026, 12:18 PM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 31, 2026, 12:18 PM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 31, 2026, 12:25 AM UTC120 bytes within scanner limit
Basis: harmless scanner · Aug 31, 2026, 12:25 AM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 31, 2026, 12:25 AM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 31, 2026, 12:25 AM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 31, 2026, 12:25 AM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 31, 2026, 12:25 AM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 31, 2026, 12:25 AM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 31, 2026, 12:25 AM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 31, 2026, 12:25 AM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 31, 2026, 12:25 AM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 31, 2026, 12:25 AM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 31, 2026, 12:25 AM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 31, 2026, 12:25 AM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 31, 2026, 12:25 AM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 30, 2026, 12:23 PM UTC120 bytes within scanner limit
Basis: harmless scanner · Aug 30, 2026, 12:23 PM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 30, 2026, 12:23 PM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 30, 2026, 12:23 PM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 30, 2026, 12:23 PM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 30, 2026, 12:23 PM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 30, 2026, 12:23 PM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 30, 2026, 12:23 PM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 30, 2026, 12:23 PM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 30, 2026, 12:23 PM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 30, 2026, 12:23 PM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 30, 2026, 12:23 PM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 30, 2026, 12:23 PM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 30, 2026, 12:23 PM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 30, 2026, 6:20 AM UTC142 bytes within scanner limit
Basis: harmless scanner · Aug 30, 2026, 6:20 AM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 30, 2026, 6:20 AM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 30, 2026, 6:20 AM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 30, 2026, 6:20 AM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 30, 2026, 6:20 AM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 30, 2026, 6:20 AM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 30, 2026, 6:20 AM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 30, 2026, 6:20 AM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 30, 2026, 6:20 AM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 30, 2026, 6:20 AM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 30, 2026, 6:20 AM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 30, 2026, 6:20 AM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 30, 2026, 6:20 AM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 30, 2026, 12:22 AM UTC120 bytes within scanner limit
Basis: harmless scanner · Aug 30, 2026, 12:22 AM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 30, 2026, 12:22 AM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 30, 2026, 12:22 AM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 30, 2026, 12:22 AM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 30, 2026, 12:22 AM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 30, 2026, 12:22 AM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 30, 2026, 12:22 AM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 30, 2026, 12:22 AM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 30, 2026, 12:22 AM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 30, 2026, 12:22 AM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 30, 2026, 12:22 AM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 30, 2026, 12:22 AM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 30, 2026, 12:22 AM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 30, 2026, 12:21 AM UTC156 bytes within scanner limit
Basis: harmless scanner · Aug 30, 2026, 12:21 AM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 30, 2026, 12:21 AM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 30, 2026, 12:21 AM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 30, 2026, 12:21 AM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 30, 2026, 12:21 AM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 30, 2026, 12:21 AM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 30, 2026, 12:21 AM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 30, 2026, 12:21 AM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 30, 2026, 12:21 AM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 30, 2026, 12:21 AM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 30, 2026, 12:21 AM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 30, 2026, 12:21 AM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 30, 2026, 12:21 AM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 29, 2026, 6:23 PM UTC130 bytes within scanner limit
Basis: harmless scanner · Aug 29, 2026, 6:23 PM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 29, 2026, 6:23 PM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 29, 2026, 6:23 PM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 29, 2026, 6:23 PM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 29, 2026, 6:23 PM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 29, 2026, 6:23 PM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 29, 2026, 6:23 PM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 29, 2026, 6:23 PM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 29, 2026, 6:23 PM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 29, 2026, 6:23 PM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 29, 2026, 6:23 PM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 29, 2026, 6:23 PM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 29, 2026, 6:23 PM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 29, 2026, 12:21 PM UTC3189 bytes within scanner limit
Basis: harmless scanner · Aug 29, 2026, 12:21 PM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 29, 2026, 12:21 PM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 29, 2026, 12:21 PM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 29, 2026, 12:21 PM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 29, 2026, 12:21 PM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 29, 2026, 12:21 PM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 29, 2026, 12:21 PM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 29, 2026, 12:21 PM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 29, 2026, 12:21 PM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 29, 2026, 12:21 PM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 29, 2026, 12:21 PM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 29, 2026, 12:21 PM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 29, 2026, 12:21 PM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 29, 2026, 12:20 PM UTC3596 bytes within scanner limit
Basis: harmless scanner · Aug 29, 2026, 12:20 PM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 29, 2026, 12:20 PM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 29, 2026, 12:20 PM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 29, 2026, 12:20 PM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 29, 2026, 12:20 PM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 29, 2026, 12:20 PM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 29, 2026, 12:20 PM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 29, 2026, 12:20 PM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 29, 2026, 12:20 PM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 29, 2026, 12:20 PM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 29, 2026, 12:20 PM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 29, 2026, 12:20 PM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 29, 2026, 12:20 PM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 29, 2026, 12:20 PM UTC6157 bytes within scanner limit
Basis: harmless scanner · Aug 29, 2026, 12:20 PM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 29, 2026, 12:20 PM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 29, 2026, 12:20 PM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 29, 2026, 12:20 PM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 29, 2026, 12:20 PM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 29, 2026, 12:20 PM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 29, 2026, 12:20 PM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 29, 2026, 12:20 PM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 29, 2026, 12:20 PM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 29, 2026, 12:20 PM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 29, 2026, 12:20 PM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 29, 2026, 12:20 PM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 29, 2026, 12:20 PM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 29, 2026, 12:19 PM UTC395 bytes within scanner limit
Basis: harmless scanner · Aug 29, 2026, 12:19 PM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 29, 2026, 12:19 PM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 29, 2026, 12:19 PM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 29, 2026, 12:19 PM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 29, 2026, 12:19 PM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 29, 2026, 12:19 PM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 29, 2026, 12:19 PM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 29, 2026, 12:19 PM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 29, 2026, 12:19 PM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 29, 2026, 12:19 PM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 29, 2026, 12:19 PM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 29, 2026, 12:19 PM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 29, 2026, 12:19 PM UTCAPI catalog source returned HTTP 404; prior advertised links were withdrawn
Basis: RFC 9727 discovery response · Aug 29, 2026, 12:23 AM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 29, 2026, 12:23 AM UTC115023 bytes within scanner limit
Basis: harmless scanner · Aug 29, 2026, 12:23 AM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 29, 2026, 12:23 AM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 29, 2026, 12:23 AM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 29, 2026, 12:23 AM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 29, 2026, 12:23 AM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 29, 2026, 12:23 AM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 29, 2026, 12:23 AM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 29, 2026, 12:23 AM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 29, 2026, 12:23 AM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 29, 2026, 12:23 AM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 29, 2026, 12:23 AM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 29, 2026, 12:23 AM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 29, 2026, 12:23 AM UTC28 payment offer(s) accepted
Basis: harmless discovery response · Aug 28, 2026, 6:22 PM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 28, 2026, 6:22 PM UTC27 bytes within scanner limit
Basis: harmless scanner · Aug 28, 2026, 6:22 PM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 28, 2026, 6:22 PM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 28, 2026, 6:22 PM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 28, 2026, 6:22 PM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 28, 2026, 6:22 PM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 28, 2026, 6:22 PM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 28, 2026, 6:22 PM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 28, 2026, 6:22 PM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 28, 2026, 6:22 PM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 28, 2026, 6:22 PM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 28, 2026, 6:22 PM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 28, 2026, 6:22 PM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 28, 2026, 6:22 PM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 28, 2026, 6:21 PM UTC34 bytes within scanner limit
Basis: harmless scanner · Aug 28, 2026, 6:21 PM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 28, 2026, 6:21 PM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 28, 2026, 6:21 PM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 28, 2026, 6:21 PM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 28, 2026, 6:21 PM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 28, 2026, 6:21 PM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 28, 2026, 6:21 PM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 28, 2026, 6:21 PM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 28, 2026, 6:21 PM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 28, 2026, 6:21 PM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 28, 2026, 6:21 PM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 28, 2026, 6:21 PM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 28, 2026, 6:21 PM UTCRequires paid or state-changing behavior outside scanner scope
Basis: Tempo Aug 24 research class · Prior art: https://github.com/wevm/mppx/pull/510#discussion_r3377899233 · Aug 28, 2026, 6:20 AM UTC17824 bytes within scanner limit
Basis: harmless scanner · Aug 28, 2026, 6:20 AM UTCNo MPP Payment challenge observed
Basis: unauthenticated HTTP response · Aug 28, 2026, 6:20 AM UTCChannel and settlement lifecycle require credentials or payments
Basis: public economic-security prior art · Aug 28, 2026, 6:20 AM UTCConcurrency and paid state changes are prohibited
Basis: public economic-security prior art · Aug 28, 2026, 6:20 AM UTCScanner never sends credentials or payments
Basis: methodology · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 28, 2026, 6:20 AM UTCNo current Payment challenge exposes session or authorization inputs
Basis: observable challenge values only · Aug 28, 2026, 6:20 AM UTCSignature and fee-payer relationships are not observable unauthenticated
Basis: public economic-security prior art · Aug 28, 2026, 6:20 AM UTCHTTPS fetch completed with platform certificate validation
Basis: platform TLS validation · Aug 28, 2026, 6:20 AM UTCScanner does not select, downgrade, or execute payment methods
Basis: public economic-security prior art · Aug 28, 2026, 6:20 AM UTCRequires a completed paid interaction outside scanner scope
Basis: public economic-security prior art · Aug 28, 2026, 6:20 AM UTC0 redirects; every hop passed URL and DNS validation
Basis: harmless scanner · Aug 28, 2026, 6:20 AM UTCScanner never replays signed credentials
Basis: public advisory and protocol prior art · Prior art: https://github.com/advisories/GHSA-fxc9-7j2w-vx54 · Aug 28, 2026, 6:20 AM UTC1 hop(s) resolved twice to stable public addresses
Basis: scanner URL, DNS and redirect policy · Aug 28, 2026, 6:20 AM UTCResponse exceeds 262144 bytes
Basis: scanner policy decision · Aug 25, 2026, 7:20 PM UTCsecurity:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/.well-known/api-catal… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/.well-known/api-catal…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/.well-known/api-catal… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/.well-known/api-catal…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/.well-known/api-catal… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/.well-known/api-catal…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco…
Evidence: Repeated harmless observation changed the modeled property
security:probe_safety: {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/openapi.json was reco… → {"state":"observed","evidence":"cross-host-redirect: Cross-host redirect to https://dripstack.com/ was recorded but not…
Evidence: Repeated harmless observation changed the modeled property