Evidence row 1793789

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://2s.io/api/security/http-headers"
    ]
  ],
  "name": "2s",
  "owner_address": "0x2b6d4988db4723e6908db86ab2b8dfbc51fc32c5",
  "raw": {
    "accepts": [
      {
        "amount": "4500",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 60,
        "network": "eip155:8453",
        "payTo": "0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5",
        "scheme": "exact"
      },
      {
        "amount": "4500",
        "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
        "extra": {
          "feePayer": "BFK9TLC3edb13K6v4YyH3DwPb5DSUpkWvb7XnqCL9b4F",
          "name": "USDC",
          "version": "1"
        },
        "maxTimeoutSeconds": 60,
        "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
        "payTo": "TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn",
        "scheme": "exact"
      }
    ],
    "description": "Fetch a URL and grade its HTTP security headers. Pass url (scheme optional — defaults to https). Returns an overall letter grade + score, the list of present/missing headers, and a per-header analysis with the live value and specific issues for: Strict-Transport-Security (HSTS max-age/includeSubDomains), Content-Security-Policy (flags 'unsafe-inline'/'unsafe-eval'/missing default-src), X-Frame-Options or CSP frame-ancestors (clickjacking), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener/Resource-Policy. Also flags Server/X-Powered-By info disclosure. Analyzed from the target's LIVE response headers through an SSRF-guarded fetch (private/loopback targets refused) — an LLM cannot see a site's current headers. For web-app security review, vendor assessment, and CI gates.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "url": "https://example.com"
            },
            "type": "http"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "properties": {
                "method": {
                  "const": "GET"
                },
                "queryParams": {
                  "properties": {
                    "url": {
                      "description": "URL to analyze (scheme optional).",
                      "type": "string"
                    }
                  },
                  "required": [
                    "url"
                  ]
                },
                "type": {
                  "const": "http"
                }
              },
              "required": [
                "type",
                "method",
                "queryParams"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "iconUrl": "https://res.cloudinary.com/bdb-prod/image/upload/c_fill,ar_1:1,w_256,h_256,f_auto,q_auto/v1781454341/bazaar-icons/58f7ba8f2b3b8047.png",
    "lastUpdated": "2026-10-08T06:13:46.25Z",
    "quality": {
      "l30DaysTotalCalls": 2,
      "l30DaysUniquePayers": 2,
      "lastCalledAt": "2026-10-08T06:13:46.085Z"
    },
    "resource": "https://2s.io/api/security/http-headers",
    "serviceName": "2s",
    "tags": [
      "public-records",
      "identifiers",
      "ai-agents",
      "us-gov-data",
      "x402"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Fetch a URL and grade its HTTP security headers. Pass url (scheme optional — defaults to https). Returns an overall letter grade + score, the list of present/missing headers, and a per-header analysis with the live value and specific issues for: Strict-Transport-Security (HSTS max-age/includeSubDomains), Content-Security-Policy (flags 'unsafe-inline'/'unsafe-eval'/missing default-src), X-Frame-Options or CSP frame-ancestors (clickjacking), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener/Resource-Policy. Also flags Server/X-Powered-By info disclosure. Analyzed from the target's LIVE response headers through an SSRF-guarded fetch (private/loopback targets refused) — an LLM cannot see a site's current headers. For web-app security review, vendor assessment, and CI gates."
}

What the leaf hashes

{"body":"a9c9d4f6537671bc5a2c5867ce8c7b28ceb21dfc86a2cd53970e2cc5405ef082","id":1793789,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793560049567809,"prev":60359,"subject":"x402_bazaar:https://2s.io/api/security/http-headers","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-11-01 (302406 rows).

1. 0x759e00d75603e704dc0e2cdaf09ab41423ec47db8cbd473f9c41c059a7fe976a
2. 0xa878f827cbb88d66cd9e02852af073f7d38814a3e112f8f4431e86e03afcbc6b
3. 0x073802fc410ca45c50b4e4c15e63271b7392fae5192772f53206a8248935f1d1
4. 0x8b2a49c6da48b39a864d8e54e65057830a5682790c9e03dafca250a1df7c00ca
5. 0x0e0bcae8fd710475dadb43803241e001d7e157e1f0cf8449e7c3d99c22bfe85f
6. 0x6440daca61a79abb9d0ea368ea3fdf4e877c8b2299ed16ab1eb167e579b9e874
7. 0x8c2dcc7fd1029a81ddc4f0e311db7f414a21b45131282696422e6abc05a41dd9
8. 0x49b2e18cd6851696b8b68d464804d9d15332a69bd7c42943bef8457ee7a46f88
9. 0x45d8afd24f11823568b3b6ecdaee6d4542426502a1a1db82b5dd7db44e7a31ac
10. 0x0688076ddbe6c9e5e5e39ce14425fdb1936b933c54ff71b42c4e1d6444f9f3fa
11. 0xc76da62af966ce1abddcfd5dadc958126f88913c21ca8b27e1027a7e7502ac0a
12. 0x7db75c7aace077c417d768719a6bf43b859889f737d52a7a24f768c32a757f76
13. 0xeed7e951b5e4701a6d9e1ccb44369bdaeb14efaf3655042a73f8487da4230bf1
14. 0x3c3408392402b125bd2c2cfb11c655ba3e5ef4f456caee26d4ee38a093e93c53
15. 0x614dbc600bca0766e288d2a5ebb7709ac565230ac6acdc88a5e4a7a5ff53c58e
16. 0xe329dbfb0db2c7f35334e66970a8ee37ee2d3356d34d692c10f84b6f7de65a35
17. 0x0c618c42b286ad61acd8204aa6dcf024b8b041d3759aa585bf4e221abc39cb5d
18. 0x6142ac48fda269c17791c79da99c2456ac6acfe98268f4d168a404fd6040c703
19. 0x3315fd2757fdd435852cc277377234a3f3909a6d2a089d0e36f6d59aacfda910

Day root

0x7fa2cba1cf3d6b35630896f5fe1a650adb307ea2c376e80a5f2d9276b7cb5ab3

Chained

0x577ff89ba012beeff3197bcff7fa86752074bdf54205a24359cc437be2a952a4

Published

On Arc Testnet, block 70262758: 0x435bc1b9331471d72e1998f2e420983b5189d4da65ffbd6f27ef40daf5e1ea90