← The evidence ledger
Evidence row 2201988
Observed , by sync.x402_bazaar/1.
- Kind
- listing
- About
- source_record x402_bazaar:https://dev-reference.x402tookit.com/csp-explain
- Recorded
- Previous row
- None: the first of its kind about this subject
- Body SHA-256
- 167b5321242d452cf2b7de248a19d9f83be1b1b631c1657a65e28be8579e3f88
- Leaf
- 0xd94028e69626f8882e3cb25e07de74a95cd6e634b015220eb1645e833c1acc36
What was observed
{
"endpoints": [
[
"x402",
"https://dev-reference.x402tookit.com/csp-explain"
]
],
"name": "Dev Reference",
"owner_address": "0xb531320805c5bed1d46aeadcf4f008fdf172dbda",
"raw": {
"accepts": [
{
"amount": "20000",
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:8453",
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"scheme": "exact"
},
{
"amount": "20000",
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"feePayer": "D6ZhtNQ5nT9ZnTHUbqXZsTx5MH2rPFiBBggX4hY1WePM",
"transactionVersions": [
0
]
},
"maxTimeoutSeconds": 300,
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"payTo": "DUPiupXtuox38dcGoXUKer5mAydCzmaHjrbQ66qeEm8s",
"scheme": "exact"
},
{
"amount": "20000",
"asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:137",
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"scheme": "exact"
},
{
"amount": "20000",
"asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831",
"extra": {
"name": "USD Coin",
"version": "2"
},
"maxTimeoutSeconds": 300,
"network": "eip155:42161",
"payTo": "0xb531320805C5BED1D46AEaDcF4F008FDF172DBDa",
"scheme": "exact"
}
],
"description": "Parse a Content-Security-Policy header value, explain each directive and flag risky settings like unsafe-inline.",
"extensions": {
"bazaar": {
"info": {
"input": {
"method": "GET",
"queryParams": {
"value": "default-src 'self'; script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src *"
},
"type": "http"
},
"output": {
"example": {
"asOf": "2026-10-11T14:26:44.554Z",
"degraded": false,
"directiveCount": 3,
"directives": [
{
"directive": "default-src",
"meaning": "Fallback for every fetch directive that is not set.",
"policy": 1,
"sources": "'self'"
},
{
"directive": "script-src",
"meaning": "Where scripts may load from and whether inline scripts and eval run.",
"policy": 1,
"sources": "'self' 'unsafe-inline' https://cdn.jsdelivr.net"
}
],
"disclaimer": "Screening signal computed from the named public source. Not financial, legal or investment advice; provided as is. Verify at the source before acting.",
"flags": [
{
"directive": "script-src",
"fix": "Use nonces or hashes instead of 'unsafe-inline'.",
"message": "'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.",
"severity": "HIGH"
},
{
"directive": "script-src",
"fix": "Prefer nonces or hashes with 'strict-dynamic'.",
"message": "cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.",
"severity": "MEDIUM"
}
],
"highCount": 1,
"infoCount": 0,
"lowCount": 4,
"mediumCount": 2,
"notChecked": [
"whether the policy is delivered as enforced or report-only, or in a meta tag (frame-ancestors, report-uri and sandbox are ignored in meta tags)",
"your application's real behaviour: nonces must be unpredictable and unique per response, which cannot be seen in a header value",
"…3 more"
],
"policyCount": 1,
"reasons": [
"HIGH: 'unsafe-inline' in script-src allows inline scripts and javascript: URLs, so injected markup can run script.",
"MEDIUM: cdn.jsdelivr.net in script-src serves content an attacker can influence (user uploads, JSONP or open package mirrors), which bypasses the allow-list.",
"…5 more"
],
"source": "W3C Content Security Policy Level 3 rules, computed locally",
"summary": "3 directives parsed: 1 high, 2 medium, 4 low risk flags.",
"verdict": "CSP_HIGH_RISK"
},
"type": "json"
}
},
"schema": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"input": {
"additionalProperties": false,
"properties": {
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"properties": {
"value": {
"description": "The header value, for example default-src 'self'; script-src 'self' 'unsafe-inline'",
"type": "string"
}
},
"required": [
"value"
],
"type": "object"
},
"type": {
"const": "http",
"type": "string"
}
},
"required": [
"type",
"method"
],
"type": "object"
},
"output": {
"properties": {
"example": {
"properties": {
"asOf": {
"type": [
"null",
"string"
]
},
"degraded": {
"type": [
"boolean",
"null"
]
},
"directiveCount": {
"type": [
"null",
"number"
]
},
"directives": {
"items": {
"properties": {
"directive": {
"type": [
"null",
"string"
]
},
"meaning": {
"type": [
"null",
"string"
]
},
"policy": {
"type": [
"null",
"number"
]
},
"sources": {
"type": [
"null",
"string"
]
}
},
"type": "object"
},
"type": [
"array",
"null"
]
},
"disclaimer": {
"type": [
"null",
"string"
]
},
"flags": {
"items": {
"properties": {
"directive": {
"type": [
"null",
"string"
]
},
"fix": {
"type": [
"null",
"string"
]
},
"message": {
"type": [
"null",
"string"
]
},
"severity": {
"type": [
"null",
"string"
]
}
},
"type": "object"
},
"type": [
"array",
"null"
]
},
"highCount": {
"type": [
"null",
"number"
]
},
"infoCount": {
"type": [
"null",
"number"
]
},
"lowCount": {
"type": [
"null",
"number"
]
},
"mediumCount": {
"type": [
"null",
"number"
]
},
"notChecked": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"policyCount": {
"type": [
"null",
"number"
]
},
"reasons": {
"items": {
"type": "string"
},
"type": [
"array",
"null"
]
},
"source": {
"type": [
"null",
"string"
]
},
"summary": {
"type": [
"null",
"string"
]
},
"verdict": {
"type": [
"null",
"string"
]
}
},
"type": "object"
},
"type": {
"type": "string"
}
},
"required": [
"type"
],
"type": "object"
}
},
"required": [
"input"
],
"type": "object"
}
}
},
"lastUpdated": "2026-11-01T22:48:49.28Z",
"quality": {
"l30DaysTotalCalls": 2,
"l30DaysUniquePayers": 2,
"lastCalledAt": "2026-11-01T22:48:49.011Z"
},
"resource": "https://dev-reference.x402tookit.com/csp-explain",
"serviceName": "Dev Reference",
"tags": [
"csp",
"security-headers",
"http",
"xss"
],
"type": "http",
"x402Version": 2
},
"source": "x402_bazaar",
"summary": "Parse a Content-Security-Policy header value, explain each directive and flag risky settings like unsafe-inline."
}What the leaf hashes
{"body":"167b5321242d452cf2b7de248a19d9f83be1b1b631c1657a65e28be8579e3f88","id":2201988,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793646811229478,"prev":null,"subject":"x402_bazaar:https://dev-reference.x402tookit.com/csp-explain","subject_kind":"source_record"}Proof
Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of (444186 rows).
- 0xd93fe91ed6ce1b70f2b645b55fcb192fb8a95b84227ede561c658197009edf05
- 0x4a13a01b8d1e87eb241397909f023b9f44b196228b1acba1533ba222384b2094
- 0x52f654d80c4a6999ee82bace98d12942f85ecddd73fcdc6baefb1d923fe67348
- 0xf949a66966ba8aa611745388e3ec2c73abc54d681dcd66dc92c71ddb978774c8
- 0xf6f52ebe6aa94163ded8a28b225c5211e3767750302dbe4199129fac0530750d
- 0x5fff623b53e5162cec2ca9d7a5645ee9d8f7e45e7ad03b14ab2fe68c1cc897f7
- 0xd9cf26ea66c922a4110a35691eda3a46b879d5fca7089091141d2b7a5faf2435
- 0x877aa0b90ca8b43dcd60309c97f6ced22fcb3f6a58e5f52a662189e9a5eca180
- 0xd37f2912940d7538ff75f56cd912d11f6b3aed6e3a00104cab1cef30c02a62ce
- 0xd97648265f4fc84ef8814a9e3a90d371c6b93330e682360c837cdefbc71fe0ac
- 0xb51504a9003dd92aef80567a90d27c4c36964a72258455a99e797d43710e0876
- 0x435cc71c6d86200fe212d967213b085a0a83df982afce4acfdcbc7d5c99e493a
- 0xf501fcee968477faaca9a060259336a60c82a32ca56ab2da724f950f415e8b62
- 0xaed7c1080b4ff0b1fc4f851df0f2b8b4ef86b106015aa3aaf8da39a641c41a3d
- 0xa370e8e015a32408a8112e54e5f40a8a65e871bd52bbc6f25fbd1139f2ba5b11
- 0x7ddefa7d79e7640c3fed21ee4472689415182c41a0258ab04a81d60495f4c40a
- 0xdb8bd933619a267f9790faac9839143d202be46af284371cc369cdf683f897ba
- 0x98cbbf2c68ab4c0b4db782aeb88bea1f30b02178cf8b5d3d24a931d19492ea6d
- 0x252cce55f1a3d5391c16f82d7f62494429a5f69b03486d4cfcfb7b2c96d6c884
- Day root
- 0x78fecaabbe319e56f5c4b80fc02e2052e198ad24781da8832a475ff65f2002d1
- Chained
- 0xdc35957db5d1371ca382b9152878ffece28ec7c5cb4f98fd71ddb367f8b999b2
- Published
- On Arc Testnet, block 70432815: 0x56b814612eb2e3e544153df3e91e1f7199106d1e430c7d8c6b653feeb9ebe9af