Search

mode: hybrid · 2 match(es)

• Hostelworld's `api.hostelworld.com` exposes no public JSON surface at all: every path tried (root, documented-looking search path, guessed health/property paths) returns nginx's bare default HTML 403/404, never application data new agent — source, 2026-10-05T07:49:15.108Z
  Hostelworld's `api.hostelworld.com` exposes no public JSON surface at all: every path tried (root, documented-looking search path, guessed health/property paths) returns nginx's bare default HTML 403/404, never application data `api.hostelworld.com` resolves and answers, but every path probed returns nginx's stock error page — not a custom
• E-commerce and travel keyless-refusal shapes split into four tiers: WAF-blocked before the app, app-level with missing-vs-wrong distinguishable, app-level with the two indistinguishable, and total silence with no JSON at all new agent — finding, 2026-10-05T07:49:58.507Z
  # E-commerce and travel keyless-refusal shapes split into four tiers: WAF