Evidence row 752359

What was observed

{
  "endpoints": [
    [
      "x402",
      "https://bot-bazaar.fly.dev/v1/x402/suite/web-app-security"
    ]
  ],
  "name": "Bot Bazaar",
  "owner_address": "0x847f54ae8ddfd71ed7bc930c1f7a73576fab03a9",
  "raw": {
    "accepts": [
      {
        "amount": "50000",
        "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
        "extra": {
          "name": "USD Coin",
          "version": "2"
        },
        "maxTimeoutSeconds": 300,
        "network": "eip155:8453",
        "payTo": "0x847f54ae8dDFD71ed7bC930C1f7a73576FAb03A9",
        "scheme": "exact"
      }
    ],
    "description": "Composite 7-check web security audit chaining CSP, CORS preflight, HTTP security headers, cookie flags, open-redirect, file-upload, and SSRF validation.",
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "method": "GET",
            "queryParams": {
              "url": "https://blockrun.ai/api/v1/pm/polymarket/markets"
            },
            "type": "http"
          },
          "output": {
            "example": {
              "composite_posture_score": 100,
              "composite_risk_score": 0,
              "disclaimer": "Automated composite analytical & schema audit only — not legal advice, not financial or investment advice, not tax advice, and not a formal third-party security certification.",
              "executive_grade": "A+",
              "generated_at": 1793110000,
              "prioritized_remediation_checklist": [
                "Serve Strict-Transport-Security (max-age=31536000; includeSubDomains), X-Content-Type-Options: nosniff, and X-Frame-Options: DENY.",
                "Enforce __Host- prefix + Secure + HttpOnly + SameSite=Lax/Strict on session cookies.",
                "Block RFC1918 private IPs and 169.254.169.254 metadata endpoints in outbound URL fetchers."
              ],
              "sub_check_count": 7,
              "sub_checks": {
                "cookie_security": {
                  "checks": {
                    "host_prefix_valid": true,
                    "httponly_flag": true,
                    "samesite_set": true,
                    "secure_flag": true
                  },
                  "cookie_name": "__Host-session",
                  "hardened": true,
                  "valid": true
                },
                "cors_preflight": {
                  "header_allowed": true,
                  "origin_allowed": true,
                  "preflight_will_succeed": true,
                  "valid": true
                },
                "csp_policy": {
                  "checks": {
                    "has_default_src": true,
                    "no_unsafe_eval": true,
                    "no_wildcard_script": true,
                    "restricts_scripts_or_self": true
                  },
                  "policy": "default-src 'self'; style-src 'unsafe-inline'; script-src 'none'; form-action 'self'; frame-ancestors 'none'",
                  "valid": true
                },
                "file_upload": {
                  "checks": {
                    "content_disposition_attachment": true,
                    "magic_byte_mime_check": true,
                    "randomized_storage_filename": true
                  },
                  "upload_pipeline_safe": true,
                  "valid": true
                },
                "open_redirect": {
                  "open_redirect_risk": false,
                  "redirect_target": "/dashboard/trades",
                  "safe_relative_redirect": true,
                  "valid": true
                },
                "security_headers": {
                  "checks": {
                    "frame_protection": true,
                    "hsts_1yr": true,
                    "nosniff": true,
                    "referrer_policy_set": true
                  },
                  "grade": "A",
                  "score": 100
                },
                "ssrf_filter": {
                  "host": "blockrun.ai",
                  "private_or_imds_blocked": false,
                  "scheme": "https",
                  "ssrf_safe": true,
                  "url": "https://blockrun.ai/api/v1/pm/polymarket/markets",
                  "valid": true
                }
              },
              "suite": "web-app-security",
              "title": "OWASP Web Application & Browser Hardening Suite",
              "tool": "suite/web-app-security",
              "valid": true
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "method": {
                  "enum": [
                    "GET",
                    "HEAD",
                    "DELETE"
                  ],
                  "type": "string"
                },
                "queryParams": {
                  "properties": {
                    "url": {
                      "description": "Target HTTPS URL to audit",
                      "type": "string"
                    }
                  },
                  "type": "object"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    },
    "lastUpdated": "2026-10-28T01:46:46.438Z",
    "quality": {
      "l30DaysTotalCalls": 1,
      "l30DaysUniquePayers": 1,
      "lastCalledAt": "2026-10-28T01:46:46.244Z"
    },
    "resource": "https://bot-bazaar.fly.dev/v1/x402/suite/web-app-security",
    "serviceName": "Bot Bazaar",
    "tags": [
      "x402",
      "reputation",
      "sellers",
      "base",
      "usdc"
    ],
    "type": "http",
    "x402Version": 2
  },
  "source": "x402_bazaar",
  "summary": "Composite 7-check web security audit chaining CSP, CORS preflight, HTTP security headers, cookie flags, open-redirect, file-upload, and SSRF validation."
}

What the leaf hashes

{"body":"577baadd564784190fd346f485efe6abee113fb80250700cd7a7fb47e5fa9230","id":752359,"kind":"listing","method":"sync.x402_bazaar/1","observed_us":1793178822367874,"prev":null,"subject":"x402_bazaar:https://bot-bazaar.fly.dev/v1/x402/suite/web-app-security","subject_kind":"source_record"}

Proof

Fold these into the leaf in order, hashing each sorted pair with keccak256, to reach the root of 2026-10-28 (231336 rows).

1. 0x97359407518367e769e35e482f9b21215b5ce1029d03b3f14728c084b9caa9f9
2. 0x4d3ca7cea08e320375503bb841c6544cf9aa62eb0f7448d21a0ca8acd0939855
3. 0xbc06da72e06b04686f10f60ea6bbd9b572ece88e250cc819491a95cb8799e17f
4. 0xc1f65bb1898d6b3fb1ba89f117ea924be6e59eca95957054ec4005a7300388bc
5. 0xb901593838d1b67b05a4d22e584a0bd9abe888a4375dd7d07dc8fa17f9be93f0
6. 0x221ebe832a801bbed72b532e68b214891008cbe07aaf64719726ea02cf320efd
7. 0x29e3569ff66e8690da7a431772262e16d1a2b434427734e73544874a80f3e497
8. 0x243a663d4f0af491be58b003be8c5293e0b2fda310a6123d19266bc3d77eda8f
9. 0x2527ad14a41bbe314eac11d7a8b5713325eb18251201857b0b3ef4398388e5d6
10. 0xe1fb8479a8a3a18c5815a0c68af59ef2975233adaecd4e135ea6cbc27f4bb0bd
11. 0x891ee1d037cc6ffff1f29e92f0b2976a709b4f0e3b534cb16c5656137a7fa37a
12. 0x3eea6e3529c46068533dc0c7b71df5ad1310bab2bb02c7c4768dde5e97569b01
13. 0xddcdda94a0fa130582c880a437970c1e6d81827500911acf5ca2c5b1aaafe0a6
14. 0x088061c71633d244b99c7cc0814bbe03af458b18487f352611ae649c73589766
15. 0xcf313ac43fef601c9e46f82a687b6a3c655f47c31675c1791c49de20295be63d
16. 0x0f8977bd16865247451d1ee836b084081d3d0cd17d6a07353fad0c70393c7403
17. 0xe08e8bd91858a8a10c46ecde9c29a6288b960987303173c5e882afb46ce91fa0
18. 0xe6cfe00ae4e02bc12327e45b5f3334ea5850ba3bcc8e3101d30a8189856a95af

Day root

0x2c19037464cc4c493624565f01775d6446fc78eaa118fc6865bfe2bfca9ff78e

Chained

0xd1d7dee8322ceff8f4c8d83aa1fe4a4466825c2af1c97dbde3d35db61234f7be

Published

On Arc Testnet, block 69584042: 0x8bae2b1d097834c8b458513862d70d29ee807e98dc2e863b27250131c15b35ae