NetIntel · Security Headers Analyze

import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const account = privateKeyToAccount(process.env.PRIVATE_KEY);
const fetchWithPay = wrapFetchWithPayment(fetch, account);

const res = await fetchWithPay("https://netintel.dev/security-headers/analyze", {
  method: "GET",
});
const data = await res.json();

curl -X GET \
  "https://netintel.dev/security-headers/analyze?target=https%3A%2F%2Fexample.com" \
  -H "X-PAYMENT: <signed x402 payment>"

{
  "deductions": [
    {
      "points": -5,
      "reason": "Permissions-Policy not set"
    },
    {
      "points": -2,
      "reason": "Cross-Origin-Resource-Policy not set"
    },
    {
      "points": -2,
      "reason": "Cross-Origin-Embedder-Policy not set"
    },
    {
      "points": -2,
      "reason": "Cross-Origin-Opener-Policy not set"
    },
    {
      "points": -3,
      "reason": "X-Powered-By header exposes server framework"
    }
  ],
  "errors": [],
  "grade": "B",
  "meta": {
    "duration_ms": 312
  },
  "results": {
    "anti_patterns": [
      {
        "header": "x-powered-by",
        "raw_value": "Express",
        "reason": "Information leakage — reveals server framework",
        "severity": "warn"
      }
    ],
    "content_type": "text/html; charset=utf-8",
    "final_url": "https://example.com/",
    "headers": {
      "content-security-policy": {
        "present": true,
        "raw_value": "default-src 'self'",
        "reason": "Content-Security-Policy is set with a strong policy",
        "status": "pass"
      },
      "cross-origin-embedder-policy": {
        "present": false,
        "raw_value": null,
        "reason": "Cross-Origin-Embedder-Policy not set",
        "status": "info"
      },
      "cross-origin-opener-policy": {
        "present": false,
        "raw_value": null,
        "reason": "Cross-Origin-Opener-Policy not set",
        "status": "info"
      },
      "cross-origin-resource-policy": {
        "present": false,
        "raw_value": null,
        "reason": "Cross-Origin-Resource-Policy not set",
        "status": "info"
      },
      "permissions-policy": {
        "present": false,
        "raw_value": null,
        "reason": "Permissions-Policy not set — browser features not restricted",
        "status": "warn"
      },
      "referrer-policy": {
        "present": true,
        "raw_value": "strict-origin-when-cross-origin",
        "reason": "Referrer-Policy is set to strict-origin-when-cross-origin",
        "status": "pass"
      },
      "strict-transport-security": {
        "present": true,
        "raw_value": "max-age=31536000; includeSubDomains",
        "reason": "HSTS enabled with max-age=31536000",
        "status": "pass"
      },
      "x-content-type-options": {
        "present": true,
        "raw_value": "nosniff",
        "reason": "X-Content-Type-Options is set to nosniff",
        "status": "pass"
      },
      "x-frame-options": {
        "present": true,
        "raw_value": "DENY",
        "reason": "X-Frame-Options is set to DENY",
        "status": "pass"
      },
      "x-xss-protection": {
        "present": false,
        "raw_value": null,
        "reason": "X-XSS-Protection not set — modern browsers use CSP instead",
        "status": "info"
      }
    },
    "status_code": 200,
    "summary": {
      "fail": 0,
      "info": 4,
      "pass": 6,
      "warn": 0
    }
  },
  "score": 78,
  "service": "security-headers",
  "target": "https://example.com",
  "timestamp": "2025-01-15T12:00:00.000Z",
  "warnings": []
}