generated: '2026-08-06'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + OpenAPI hosts
hosts:
- host: audigent.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Dec 18 23:59:59 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: docs.prebid.org
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 20 08:30:18 2026 GMT
  hsts: false
- host: id.hadron.ad.gt
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 29 14:54:29 2026 GMT
  hsts: null
- host: seg.hadron.ad.gt
  https: true
  tls_version: TLSv1.3
  hsts: false
- host: analytics.hadron.ad.gt
  https: true
  tls_version: TLSv1.3
  hsts: false
- host: cdn.hadronid.net
  https: true
  tls_version: TLSv1.3
  hsts: false
- host: p.ad.gt
  https: true
  tls_version: TLSv1.3
  hsts: false
- host: api.audigent.com
  https: true
  tls_version: TLSv1.3
  hsts: false
domains:
- domain: audigent.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: quarantine
- domain: prebid.org
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: quarantine
- domain: ad.gt
  dnssec: false
  caa: []
  spf: false
  dmarc: false
  dmarc_policy: null
  note: >-
    ad.gt is the primary API/identity domain (id./seg./analytics.hadron.ad.gt,
    ids.ad.gt, a.ad.gt, p.ad.gt) and has no SPF, no DMARC, no CAA and no DNSSEC.
- domain: hadronid.net
  dnssec: false
  caa: []
  spf: true
  spf_record: v=spf1 include:_spf.mailersend.net ~all
  dmarc: false
  dmarc_policy: null

x-notes:
  hosts_supplemental_method: >-
    audigent.com, docs.prebid.org and id.hadron.ad.gt were written by
    0-working/probe-domain-security.py from the apis.yml hosts. The remaining
    hosts and the ad.gt / hadronid.net domain rows were probed by hand on
    2026-08-06 (openssl s_client + dig) because they are reachable only through
    the client-side hadron.js bundle and are not apis.yml baseURL hosts.
  findings:
  - TLS 1.3 everywhere; no plaintext or downgraded host found.
  - HSTS is set on audigent.com only; none of the API or CDN hosts assert it.
  - No CAA record on any domain, and no DNSSEC on any domain.
  - >-
    docs.prebid.org / prebid.org are third-party rows: Audigent's developer
    documentation lives on the Prebid project's host, not its own, so those two
    rows describe Prebid's posture rather than Audigent's.
  - See conformance/audigent-conformance.yml for the RFC 9116 security.txt miss.