generated: '2026-08-22'
method: probed
source: live probes of https://harbingermotors.com/wp-json/ + the route index it publishes
description: >-
  Harbinger Motors publishes no developer program, no API key issuance, no OAuth application
  registration and no authentication documentation. The WordPress REST content API behind
  harbingermotors.com is anonymously readable and, anonymously, read-only. Everything below was
  observed on live responses on 2026-08-22.
public_read: true
schemes: []
declared_security_schemes: 0
anonymous_access:
  supported: true
  detail: >-
    Every operation captured in openapi/ answers 200 with no credential of any kind. The collection
    routes return `Allow: GET` to an anonymous OPTIONS, which is the server itself stating that GET
    is the only method available without authentication.
  evidence:
  - url: https://harbingermotors.com/wp-json/wp/v2/posts?per_page=2
    http_status: 200
    header: 'allow: GET'
write_access:
  supported_anonymously: false
  mechanism: WordPress application passwords (HTTP Basic over TLS) or a logged-in session nonce
  public_issuance_path: none
  detail: >-
    The same routes register POST/PUT/PATCH/DELETE endpoints, but they are capability-gated. An
    anonymous POST to /wp/v2/posts returns 401 rest_cannot_create. Application passwords can only
    be minted from inside the WordPress admin by an account Harbinger controls, so there is no path
    for a third party to obtain write credentials. Treat this surface as read-only.
  evidence:
  - url: https://harbingermotors.com/wp-json/wp/v2/posts
    method: POST
    http_status: 401
    code: rest_cannot_create
advertised_schemes:
  detail: >-
    The API index publishes an `authentication` key and it is an empty array on this host — the
    server advertises no authentication scheme at all. Application-password support is present in
    core (the /wp/v2/users/{id}/application-passwords routes are registered) but is not advertised
    as a public scheme.
  evidence:
  - url: https://harbingermotors.com/wp-json/
    http_status: 200
    observed: 'authentication: []'
gated_routes_observed:
- {route: /wp/v2/users, status: 401, code: rest_user_cannot_view}
- {route: /wp/v2/settings, status: 401, code: rest_forbidden}
- {route: /wp/v2/menus, status: 401, code: rest_cannot_view}
- {route: /wp/v2/block-types, status: 401, code: rest_block_type_cannot_view}
- {route: /wp-abilities/v1/abilities, status: 401, code: rest_forbidden}
- {route: '/wp/v2/posts?context=edit', status: 401, code: rest_forbidden_context}
transport:
  tls: true
  tls_version: TLSv1.3
  hsts: false
  note: >-
    HTTPS is enforced by redirect but no Strict-Transport-Security header is returned, so a first
    request to http:// is not protected by HSTS preloading. See security/harbinger-domain-security.yml.
note: >-
  No scopes/ artifact is emitted: there is no OAuth surface here, so a scope file would be an empty
  artifact rather than a finding.