generated: '2026-08-11'
method: searched
source: https://creditgenie.com/.well-known/
host: https://creditgenie.com
note: Credit Genie serves a real RFC 9116 security.txt from its marketing host, plus the PGP public key
  that document references. Every other well-known discovery path returns a hard 404. The company publishes
  no API, so there is no API host to probe beyond the marketing site and the consumer app host; the app
  host main.app.creditgenie.com answers 403 to every path for a non-browser client.
hosts_probed:
- host: creditgenie.com
  reachable: true
- host: www.creditgenie.com
  reachable: true
- host: app.creditgenie.com
  reachable: true
  note: consumer sign-in host; all /.well-known/* paths return 404.
- host: main.app.creditgenie.com
  reachable: true
  note: returns 403 to every path for a non-browser client.
- host: api.creditgenie.com
  reachable: false
  note: DNS does not resolve.
- host: developer.creditgenie.com
  reachable: false
  note: DNS does not resolve.
- host: docs.creditgenie.com
  reachable: false
  note: DNS does not resolve.
x-evidence:
  fetched: '2026-08-11'
  probes:
  - url: https://creditgenie.com/.well-known/security.txt
    status: 200
  - url: https://creditgenie.com/.well-known/pgp-key.asc
    status: 200
  - url: https://creditgenie.com/.well-known/api-catalog
    status: 404
  - url: https://creditgenie.com/.well-known/agent-card.json
    status: 404
  - url: https://api.creditgenie.com/openapi.json
    status: 0
    note: DNS resolution failure.
hosts:
- host: https://creditgenie.com
  documents:
  - path: /.well-known/security.txt
    status: 200
    file: credit-genie-security.txt
    content_type: text/plain
    note: RFC 9116; Contact security@creditgenie.com, Expires 2027-02-02.
  - path: /.well-known/pgp-key.asc
    status: 200
    file: credit-genie-pgp-key.asc
    content_type: application/octet-stream
    note: PGP PUBLIC key block referenced by the Encryption field of security.txt.
  - path: /.well-known/openid-configuration
    status: 404
  - path: /.well-known/oauth-authorization-server
    status: 404
  - path: /.well-known/api-catalog
    status: 404
  - path: /.well-known/ai-plugin.json
    status: 404
  - path: /.well-known/agent-card.json
    status: 404
  - path: /.well-known/agent.json
    status: 404
x-shape-fix:
  converted: '2026-08-20'
  from: documents
  note: Rewritten into hosts[] -> documents[], the only shape well_known_docs() in score.rb reads. A served
    .well-known surface recorded in any other shape scores as absent.