Evidence row 60359

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://2s.io/api/security/http-headers"
    ]
  ],
  "name": "2s",
  "owner_address": "0x2b6d4988db4723e6908db86ab2b8dfbc51fc32c5",
  "raw": {
    "accepts": [
      {
        "amount": "4500",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 60,
        "network": "eip155:8453",
        "payTo": "0x2b6D4988Db4723E6908Db86Ab2b8dFBc51FC32C5",
        "scheme": "exact"
      },
      {
        "amount": "4500",
        "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
        "extra": {
          "feePayer": "BFK9TLC3edb13K6v4YyH3DwPb5DSUpkWvb7XnqCL9b4F",
          "name": "USDC",
          "version": "1"
        },
        "maxTimeoutSeconds": 60,
        "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
        "payTo": "TW6ntaGzvj63ZgPjszd4FCGmVTGfzv1MAYZbjYcyWhn",
        "scheme": "exact"
      }
    ],
    "description": "Fetch a URL and grade its HTTP security headers. Pass url (scheme optional — defaults to https). Returns an overall letter grade + score, the list of present/missing headers, and a per-header analysis with the live value and specific issues for: Strict-Transport-Security (HSTS max-age/includeSubDomains), Content-Security-Policy (flags 'unsafe-inline'/'unsafe-eval'/missing default-src), X-Frame-Options or CSP frame-ancestors (clickjacking), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener/Resource-Policy. Also flags Server/X-Powered-By info disclosure. Analyzed from the target's LIVE response headers through an SSRF-guarded fetch (private/loopback targets refused) — an LLM cannot see a site's current headers. For web-app security review, vendor assessment, and CI gates.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "url": "https://example.com"
            },
            "type": "http"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "properties": {
                "method": {
                  "const": "GET"
                },
                "queryParams": {
                  "properties": {
                    "url": {
                      "description": "URL to analyze (scheme optional).",
                      "type": "string"
                    }
                  },
                  "required": [
                    "url"
                  ]
                },
                "type": {
                  "const": "http"
                }
              },
              "required": [
                "type",
                "method",
                "queryParams"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "iconUrl": "https://res.cloudinary.com/bdb-prod/image/upload/c_fill,ar_1:1,w_256,h_256,f_auto,q_auto/v1781454341/bazaar-icons/58f7ba8f2b3b8047.png",
    "lastUpdated": "2026-10-08T06:13:46.25Z",
    "quality": {
      "l30DaysTotalCalls": 4,
      "l30DaysUniquePayers": 3,
      "lastCalledAt": "2026-10-08T06:13:46.085Z"
    },
    "resource": "https://2s.io/api/security/http-headers",
    "serviceName": "2s",
    "tags": [
      "public-records",
      "identifiers",
      "ai-agents",
      "us-gov-data",
      "x402"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Fetch a URL and grade its HTTP security headers. Pass url (scheme optional — defaults to https). Returns an overall letter grade + score, the list of present/missing headers, and a per-header analysis with the live value and specific issues for: Strict-Transport-Security (HSTS max-age/includeSubDomains), Content-Security-Policy (flags 'unsafe-inline'/'unsafe-eval'/missing default-src), X-Frame-Options or CSP frame-ancestors (clickjacking), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener/Resource-Policy. Also flags Server/X-Powered-By info disclosure. Analyzed from the target's LIVE response headers through an SSRF-guarded fetch (private/loopback targets refused) — an LLM cannot see a site's current headers. For web-app security review, vendor assessment, and CI gates."
}

What the leaf hashes

{"body":"94a53a9cc59a5545705b034d9fd8207b84c55aa2c918f6131a0c8ac7d042a757","id":60359,"kind":"listing","method":"baseline/1","observed_us":1793025448381678,"prev":null,"subject":"x402_bazaar:https://2s.io/api/security/http-headers","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-26 (296695 rows).

1. 0xbdb989f747fbb0a30fdb4c66c92c915ed8a65769f157b1c6381bb40487d4bc65
2. 0xae3ddc886709ad1c1c0a6b70590c846c80950d0135674f2a6c8ee536aeee810a
3. 0x54c1c0702a6a44d0f2f74f5b0a5af86d6cf2061d0808142e5a777dcdc6020cd9
4. 0x34188c1f73d57ea836e56fc92a9821d5f3e8c6ed0bf55ed9769ab3c7c677727e
5. 0xd0aa589fb45d7be1c05a2dd05dacd81a1ed436b9686e7a9f6a020075c13bcfa0
6. 0xe9014bbbb13d07220923ffab5c69dfaeac12e113c39ddf01fd478c00624b6dc0
7. 0xe04c50bd64cb687fb9eadce3d6f680327fce85798c40ba0703ba18f9465da440
8. 0xa693bb9295d036baeb4b498fe727f2f0a582085884999078e1fe0316576e7b26
9. 0x9526bcec5203a2d2bf4d8ced6bfa4e5bdea2a8d30f09b2614941f3f6d1c6bd91
10. 0xa8048983031bd787175feb9b6005110e63644ce412e11f8e1c15af8a960bfe20
11. 0x135102b1595b48b3b1604ed9b55766b9654dc2e33631a8be15cb316d09a36075
12. 0xa6f71fd6c3a59323bf7c5386a54935b14c555d8c717289cc73700f56d86994cd
13. 0xd5b5bb5812612371a70171b2252d90e95bb0581ea5a3be198122adc8442e4f79
14. 0xf692ce2b0a640ec9f75aa960e5fb1c2c7091a04e24881798735752c19014e519
15. 0x9f68b5e15459cb62b8c0cd4c124fa61c74147b4a5755a200fbecd21a581635d1
16. 0x123ec8bee20ddc55223eeef5a4f4d6c4b6416515adbb911c56759f5cde56e452
17. 0xd0651cb9bc8155eb52b5247d506e74b8a935057dc190ba52091702ac25ed3a40
18. 0x9a9024edb5069d88a324facb310a5ce8e495214bbaa968f077bede437390194f
19. 0x9b9ce5b74b9bab5121612ef6b64920a8d453cbf311096a423eef9702747e868a

Day root

0xf43e8dcc3d451a4788b26be904c55e8c4c0fa75c9666796c51db38d37e2c0df8

Chained

0x702d5ac508f08b0d1accf36af25822d8e5660367494edd17a642fb61e158a57a

Published

On Arc Testnet, block 69251483: 0x495162f8936e19f0039918feebe6c307f327cd6bf8c37219620b1970041fa9ae