Evidence row 3769481

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://2s.io/api/security/http-headers"
    ]
  ],
  "name": "2s",
  "owner_address": "0x2b6d4988db4723e6908db86ab2b8dfbc51fc32c5",
  "raw": {
    "accepts": [
      {
        "amount": "4500",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 60,
        "network": "eip155:8453",
        "payTo": "0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5",
        "scheme": "exact"
      },
      {
        "amount": "4500",
        "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
        "extra": {
          "feePayer": "BFK9TLC3edb13K6v4YyH3DwPb5DSUpkWvb7XnqCL9b4F",
          "name": "USDC",
          "version": "1"
        },
        "maxTimeoutSeconds": 60,
        "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
        "payTo": "TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn",
        "scheme": "exact"
      }
    ],
    "description": "Fetch a URL and grade its HTTP security headers. Pass url (scheme optional — defaults to https). Returns an overall letter grade + score, the list of present/missing headers, and a per-header analysis with the live value and specific issues for: Strict-Transport-Security (HSTS max-age/includeSubDomains), Content-Security-Policy (flags 'unsafe-inline'/'unsafe-eval'/missing default-src), X-Frame-Options or CSP frame-ancestors (clickjacking), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener/Resource-Policy. Also flags Server/X-Powered-By info disclosure. Analyzed from the target's LIVE response headers through an SSRF-guarded fetch (private/loopback targets refused) — an LLM cannot see a site's current headers. For web-app security review, vendor assessment, and CI gates.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "url": "https://example.com"
            },
            "type": "http"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "properties": {
                "method": {
                  "const": "GET"
                },
                "queryParams": {
                  "properties": {
                    "url": {
                      "description": "URL to analyze (scheme optional).",
                      "type": "string"
                    }
                  },
                  "required": [
                    "url"
                  ]
                },
                "type": {
                  "const": "http"
                }
              },
              "required": [
                "type",
                "method",
                "queryParams"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "iconUrl": "https://res.cloudinary.com/bdb-prod/image/upload/c_fill,ar_1:1,w_256,h_256,f_auto,q_auto/v1781454341/bazaar-icons/58f7ba8f2b3b8047.png",
    "lastUpdated": "2026-10-08T06:13:46.25Z",
    "quality": {
      "l30DaysTotalCalls": 1,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-10-08T06:13:46.085Z"
    },
    "resource": "https://2s.io/api/security/http-headers",
    "serviceName": "2s",
    "tags": [
      "public-records",
      "identifiers",
      "ai-agents",
      "us-gov-data",
      "x402"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Fetch a URL and grade its HTTP security headers. Pass url (scheme optional — defaults to https). Returns an overall letter grade + score, the list of present/missing headers, and a per-header analysis with the live value and specific issues for: Strict-Transport-Security (HSTS max-age/includeSubDomains), Content-Security-Policy (flags 'unsafe-inline'/'unsafe-eval'/missing default-src), X-Frame-Options or CSP frame-ancestors (clickjacking), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener/Resource-Policy. Also flags Server/X-Powered-By info disclosure. Analyzed from the target's LIVE response headers through an SSRF-guarded fetch (private/loopback targets refused) — an LLM cannot see a site's current headers. For web-app security review, vendor assessment, and CI gates."
}

What the leaf hashes

{"body":"913ad1009fc4eafd4883e2f51bfd5f9a600be53ea59803e3a0ae4170b569fc35","id":3769481,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793996846560688,"prev":1793789,"subject":"x402_bazaar:https://2s.io/api/security/http-headers","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-11-06 (303443 rows).

1. 0xabe6d28873d4171f6d7a0a18243cf8ef1ac9f67278675dfd21d179c9c10af65d
2. 0x1e7f59f160a8b6275655b090c87eaca626b6546b3d86407066533cee54b91a26
3. 0xb22d5f0be2517ac2f136cba8b98cb2680ad50cc1ad0da0533481735d0ef8150d
4. 0x711eaeba5e10d58fb4b2d1da1db35ec730af48c634e74646dc0730ab8eab0d9f
5. 0x80fe2534409cabd10325b64e74e2e491984da2be9188650473747750eb021cf7
6. 0x87ffab84486376c85ebd853f223816950f6429318ee0ea963fdad254e1ca717d
7. 0xb63e7c0ac7664ef928dd82dcd18bbb91321eb1a20fea78ff0d196321d65ae9bb
8. 0x044b0c4722cb64a7dbbd077bcbf0c4c0a58fda8f8d44602b0bbaab24f8ab0d1b
9. 0x7ba8f0e878a1d53d40f36b34e6593dc688ed313754b726f21810b1b294a02f26
10. 0xe89d5360724dbfeebc4cafffd87d64f5578e237dadd88aea382bf750ac9f35c4
11. 0x5bda9b96d188016ef44ea0ad567e14be53dd09bd66dbbd7bddc831dc0dda87db
12. 0xe84844d76050c5b5e7260ed613241489493ac4b6445dceaf2045de4d86140769
13. 0xba7ebe9d05d8eb0dcba14a0215eb0230a8378594bf0416458cb8ec3fedf19acd
14. 0xb8cdc3434f126e876ea2c3ff38768a8afbd1988aaba81d57ab2a78f3dfcd545b
15. 0xb12c082ef1a62be55def66eb167199a0d5bfcaf36f2f6e389298bc918cf1b0bc
16. 0x4a5b4dca6c638b7872bc6485359586bebc62511ba2776f1ea54dfdaa4d1a511b
17. 0xf19d501fdbc28e10c3244253daf0c37c4752659eae14a7cba585a18c7df9ce0d
18. 0xd422a75f6c3780ed53eca52b50bf40b8f17dc14cffb804142e44fc9f2672029d
19. 0xc0d08d48601d1be90bcfc025e66bcaa0030120d688dd9c919b36c2c4446f4948

Day root

0xb30ccefe7182c6f767e1fcbfb5f64ffd649da831f665f65c5ff39cd40512284f

Chained

0xc383f7ef68d2914082484765aa09e42c12c59a74a096ae64127c562618c506d3

Published

On Arc Testnet, block 71111178: 0xfba13cb7ee4ada7f2fee3702a786a2201596be2ffea37dfc281ab4c8e9942fe1