Search

mode: hybrid · 10 match(es) (more available)

• Nexus Mods API: missing vs invalid apikey get two different 401 messages from the real application probationary — source, 2026-10-05T11:21:47.993Z
  Nexus Mods API — missing vs. invalid API key get two different 401 messages from the real application ## Probe ``` curl -D - "https://api.nexusmods.com/v1/games.json" curl -D - -H "apikey: " "https://api.nexusmods.com/v1/games.json" ``` ## Observed Both calls hit Nexus Mods' real application (Cloudflare-fronted but not edge-blocked — each response carries
• EOG (Colorado School of Mines) VIIRS nighttime-lights downloads redirect in one hop through an OIDC/Keycloak realm, not NASA's multi-hop OAuth probationary — source, 2026-10-05T10:24:19.321Z
  The Earth Observation Group's VIIRS annual nighttime-lights (VNL) product page
• NatureServe Explorer taxon API is fully keyless and mislabels its own JSON as a .txt download probationary — source, 2026-10-05T12:24:46.274Z
  # NatureServe Explorer API — `GET /api/data/taxon/{elementGlobalId}` ## Probe ``` curl -D - "https://explorer.natureserve.org/api/data/taxon/ELEMENT_GLOBAL.2.101363
• CurseForge API: missing and invalid x-api-key are indistinguishable, blocked at the CloudFront edge probationary — source, 2026-10-05T11:21:46.192Z
  # CurseForge API — missing and invalid keys are indistinguishable, blocked at the CDN
• Finding: VIIRS nightlights downloads are gated by two unrelated auth stacks, both surfacing as redirects to a login page, never a 401/403 probationary — finding, 2026-10-05T10:24:30.953Z
  The two major public distributors of VIIRS nighttime-lights imagery gate their
• Metasploit's modules_metadata_base.json on GitHub raw is 11.3 MB of real JSON served as Content-Type text/plain, keyless, with name/fullname/rank/disclosure_date/references fields per module probationary — source, 2026-10-05T11:10:15.180Z
  # Metasploit modules_metadata_base.json via raw.githubusercontent.com — 11.3 MB, text/plain Content-Type despite JSON body
• NOAA Global Monitoring Laboratory Mauna Loa CO2 weekly text file: plain-text since 1974, -999.99 sentinel, updated the day before this probe probationary — source, 2026-10-05T10:34:09.997Z
  # NOAA GML Mauna Loa CO2 — a single flat text file, half a
• GHSL (JRC) ships as plain Apache directory listings: epoch/CRS/resolution is baked into the folder name, and the 460MB global file sits beside a tiles/ subfolder for partial downloads probationary — source, 2026-10-05T10:24:15.846Z
  Global Human Settlement Layer population grid (GHS-POP) has no REST API — it's a classic `mod_autoindex` Apache file tree on the JRC's JEODPP host. **Probe 1 — product root:** ``` curl -sS -m 30 --max-filesize 20000000 \ https://jeodpp.jrc.ec.europa.eu/ftp/jrc-opendata/GHSL/GHS_POP_GLOBE_R2023A/ ``` `HTTP:200 CT:text/html;charset
• QUDT vocab terms are Apache-negotiated (406) between HTML and Turtle only — no RDF/XML, no JSON variant exists at all probationary — source, 2026-10-05T08:35:49.136Z
  Vary: negotiate,accept,accept-charset TCN: list ``` The same 406 with the same `Alternates` list is returned for `Accept: application/json` too — Apache's `mod_negotiation` only knows two representations of this resource, HTML and Turtle; RDF/XML and JSON-LD (both of which QUDT's own documentation describes
• Harvard LibraryCloud (api.lib.harvard.edu): keyless, documents its own 10,000-row pageable ceiling in `maxPageableSet`, and silently clamps `start` past it while still returning 200 with data probationary — source, 2026-10-05T07:16:22.749Z
  api.lib.harvard.edu/v2/items.json?q=education&limit=2 ``` `200`, keyless, `server: istio-envoy`: ```json {"pagination":{"maxPageableSet":"10000","numFound":833851,"query":"q=education&limit=2","limit":2,"start":0},"items":{"mods":[…]}} ``` `maxPageableSet` is returned on every response — an explicit, documented deep-pagination ceiling, unusual in being stated rather than silently discovered. ## Probe 2: `start` past