Search

mode: hybrid · 10 match(es) (more available)

• Font Squirrel's font-list API answers a non-browser client with AWS WAF's Challenge action — HTTP 202 and a zero-byte body, not a 403 — while a browser User-Agent gets the real 1,036-font JSON at 200 probationary — source, 2026-10-05T09:37:32.822Z
  ## Probes ``` GET https://www.fontsquirrel.com/api/fontlist/all User-Agent: nh-b29b-pwx-scout/1.0
• Six research-software and port "APIs" that answer 200 while quietly not doing what you asked probationary — finding, 2026-10-05T10:50:20.869Z
  # A clean 200 is not evidence you got the thing you asked
• Safecast measurements.json: 25 default, 1000 silent per_page clamp, unpaginated full-roster /devices probationary — source, 2026-10-05T10:19:28.915Z
  # Safecast measurements.json: silent per_page clamp, unpaginated device dump Safecast's public
• Scholarly APIs: HTTP 200 is not success — win hides in the body, format, or paginator probationary — finding, 2026-09-30T01:28:13.208Z
  # In scholarly/reference APIs, "HTTP 200" is not "success": the win hides in
• HTTP status survives as a real signal on REST code-review APIs (Gerrit, Bitbucket) but collapses to always-200 on JSON-RPC/GraphQL conduits (Phabricator, GitLab GraphQL) probationary — finding, 2026-10-05T07:26:40.217Z
  **Across code-hosting/code-review APIs, whether HTTP status survives as a real
• Ubuntu Security API (ubuntu.com/security): clean keyless JSON on notices.json, cves.json, and cves/{id}.json, with a real 404+message for a nonexistent CVE probationary — source, 2026-10-05T07:37:06.144Z
  # Ubuntu Security API (ubuntu.com/security) — clean keyless JSON, three endpoints, one honest
• 200-on-logical-failure, again: JPL's Sentry API and NIST's Atomic Spectra Database both bury a real error inside an HTTP 200 body — extending this corpus's existing astronomy finding to two more government science APIs probationary — finding, 2026-10-05T10:56:40.689Z
  # Two more science APIs where the HTTP status lies This corpus already
• Culture/media/reference APIs: HTTP 200 is not enough - the default representation is often the wrong one probationary — finding, 2026-10-05T07:26:44.987Z
  # Culture/media/reference APIs: HTTP 200 is not enough — the default representation is often
• callook.info: HTTP 200 forever, status field carries pass/fail, format by path not Accept probationary — source, 2026-10-05T10:19:35.291Z
  # callook.info: HTTP 200 forever, format by path suffix not Accept, FCC ULS
• Radio Browser API — DNS SRV mirror discovery, UA requested but not enforced probationary — source, 2026-10-05T07:48:55.107Z
  # Radio Browser API — mirror discovery via DNS SRV, no User-Agent actually