generated: '2026-08-13'
method: probed
source: live GET probes of every apis.yml + OpenAPI servers[] host
description: >-
  Well-known discovery probe across every Buttondown host. Buttondown serves an RFC 9116
  security.txt on both its marketing host and its documentation host; every other well-known
  path 404s. The API host (api.buttondown.com) serves no well-known documents at all.
hosts:
  - host: https://buttondown.com
    documents:
      - path: /.well-known/security.txt
        status: 200
        content_type: text/plain
        file: buttondown-security.txt
      - path: /.well-known/openid-configuration
        status: 404
      - path: /.well-known/oauth-authorization-server
        status: 404
      - path: /.well-known/oauth-protected-resource
        status: 404
      - path: /.well-known/api-catalog
        status: 404
      - path: /.well-known/ai-plugin.json
        status: 404
      - path: /.well-known/agent-card.json
        status: 404
      - path: /.well-known/agent.json
        status: 404
  - host: https://docs.buttondown.com
    documents:
      - path: /.well-known/security.txt
        status: 200
        content_type: text/plain
        note: >-
          Same document as the marketing host, with its own Expires timestamp; the Canonical field
          points back to https://buttondown.com/.well-known/security.txt, so only that one is saved.
      - path: /.well-known/openid-configuration
        status: 404
      - path: /.well-known/oauth-authorization-server
        status: 404
      - path: /.well-known/oauth-protected-resource
        status: 404
      - path: /.well-known/api-catalog
        status: 404
      - path: /.well-known/ai-plugin.json
        status: 404
      - path: /.well-known/agent-card.json
        status: 404
      - path: /.well-known/agent.json
        status: 404
  - host: https://api.buttondown.com
    documents:
      - path: /.well-known/security.txt
        status: 404
      - path: /.well-known/openid-configuration
        status: 404
      - path: /.well-known/oauth-authorization-server
        status: 404
      - path: /.well-known/oauth-protected-resource
        status: 404
      - path: /.well-known/api-catalog
        status: 404
      - path: /.well-known/ai-plugin.json
        status: 404
      - path: /.well-known/agent-card.json
        status: 404
      - path: /.well-known/agent.json
        status: 404
  - host: https://api.buttondown.email
    note: Legacy API host; redirects/serves the same Django app as api.buttondown.com.
    documents:
      - path: /.well-known/security.txt
        status: 404
      - path: /.well-known/agent-card.json
        status: 404
      - path: /.well-known/agent.json
        status: 404
summary:
  hits: 2
  security_txt: true
  openid_configuration: false
  oauth_authorization_server: false
  api_catalog: false
  ai_plugin: false
  agent_card: false