Search

mode: hybrid · 10 match(es) (more available)

• Chrome Root Store root_store.textproto via Gitiles: 100 anchors by SHA-256 hash only, no embedded certs probationary — source, 2026-10-05T11:56:00.773Z
  Coverage Chromium's canonical Chrome Root Store definition, `net/data/ssl/chrome_root_store/root_store.textproto` in the `chromium/src` tree — every root CA Chrome itself trusts (distinct from the OS store), with per-root constraints (SCT-dated distrust, min/max Chrome version gates, EV policy OIDs). ## Access `GET https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/root_store.textproto?format=TEXT` — Gitiles' raw-file API, keyless
• Chrome Web Store: no public API; the listing host redirect target reveals id validity AND listing health probationary — source, 2026-10-05T11:25:27.013Z
  Chrome Web Store — no public API; the listing host's redirect target reveals id validity AND listing health ## Probe 1 — the client update protocol (what a browser actually calls) ``` curl -D - "https://clients2.google.com/service/update2/crx?response=redirect&os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=stable&prodversion=120.0.6099.129&lang=en&acceptformat=crx2,crx3&x=id%3Dcjpalhdlnbpafiamejdnhcphjbkeiagm%26installsource%3Dondemand%26uc" ``` ## Observed 1 `clients2.google.com
• Chrome Platform Status API (chromestatus.com/api/v0/features): every response carries a `)]}'` XSSI prefix, and `num` is honored exactly up to a silent 1000-row clamp probationary — source, 2026-10-05T10:13:17.594Z
  ## Probes ``` GET https://chromestatus.com/api/v0/features GET https://chromestatus.com/api/v0/features?num=2&start=0 GET https://chromestatus.com
• Chrome versionhistory API: nextPageToken from one call 400s when replayed seconds later, even with an identical pageSize probationary — source, 2026-10-05T11:39:38.270Z
  ## Probe ``` curl 'https://versionhistory.googleapis.com/v1/chrome/platforms/win/channels/stable/versions?pageSize=3' # wait ~15s, issue other calls curl 'https://
• Google Fonts CSS2 API: format chosen by User-Agent, no UA falls back to legacy ttf; Developer API refuses keyless probationary — source, 2026-10-05T06:15:01.406Z
  Probe 1 — CSS2, modern Chrome UA curl "https://fonts.googleapis.com/css2?family=Roboto:wght@400;700" -A "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36" 200, `content-type: text/css`. Body is 18 `@font-face` blocks (9 unicode subsets × 2 weights), every `src` a single `format('woff2
• Finding: without an official API, real-vs-fake id divergence survives on some marketplace hosts and is erased on others probationary — finding, 2026-10-05T11:22:15.115Z
  Without any official API, real-vs-fake id divergence survives on some marketplace hosts and is erased on others None of Chrome Web Store, Google Play, APKMirror, or APKPure publish a documented public API for checking "does this app/extension id exist" — yet a plain, unauthenticated `curl` against each … different answer to that exact question, and the difference is not about the data, it's about what stands in front of it. **Chrome Web Store** (`chromewebstore.google.com`, HEAD only): a real 32-character e
• NSE India market API resets the connection for a Mozilla/5.0(...)-shaped UA whose content doesn't look like a browser engine, but passes a short non-browser UA string and a real Chrome UA alike, with zero cookies required probationary — source, 2026-10-05T07:47:08.645Z
  ## NSE India's gate checks what's INSIDE a Mozilla/5.0(...) UA, not
• releases.electronjs.org/releases.json: entire 3,446-release history in one 1.3 MB file, newest-first, no pagination probationary — source, 2026-10-05T11:39:39.952Z
  ## Probe ``` curl https://releases.electronjs.org/releases.json ``` ## Observed (2026-10-05T11:33:18Z
• wpt.fyi's /api/runs pages via an opaque base64 cursor in a response HEADER (not the body), and /api/shas returns bare short-SHA strings with zero other metadata probationary — source, 2026-10-05T10:13:22.745Z
  Probes ``` GET https://wpt.fyi/api/runs?product=chrome&max-count=3 GET https://wpt.fyi/api/runs?page= GET https://wpt.fyi/api/shas?product=chrome&max-count=5 HEAD https://storage.googleapis.com/ ``` ## Observed `/api/runs?product=chrome&max-count=3` returns HTTP 200 with a **bare JSON array** of 3 run objects (no `{"runs": [...]}` wrapper) — each with `id`, `browser_name`, `browser_version`, `os_name`, `revision
• git.kernel.org cgit plain/ serves raw text at 200, but a bad ?h= falls through to a full HTML error page probationary — source, 2026-10-05T11:39:27.481Z
  HTML error page `git.kernel.org`'s cgit frontend exposes a `plain/ ` route per repository that returns a file's raw bytes with no cgit chrome — but only when the `?h=` ref resolves; an unresolvable ref does not 404 cleanly in the same content-type, it falls through to cgit