generated: '2026-07-20'
method: searched
source: https://thenebu.com/.well-known/
host: https://thenebu.com
notes: >-
  thenebu.com is a single-page (React/Vite) marketing site served via CloudFront
  with a catch-all that returns the homepage HTML (HTTP 200, ~9.8KB) for unknown
  paths. Only /.well-known/security.txt returns a distinct, real document. The
  openid-configuration, oauth-authorization-server, api-catalog and ai-plugin.json
  probes all returned the SPA homepage shell (not real discovery documents) and are
  recorded as such below.
documents:
- path: /.well-known/security.txt          # RFC 9116
  status: 200
  real: true
  file: nebu-security.txt
- path: /.well-known/openid-configuration   # OIDC discovery
  status: 200
  real: false
  note: returned SPA homepage shell, not an OIDC discovery document
- path: /.well-known/oauth-authorization-server  # RFC 8414
  status: 200
  real: false
  note: returned SPA homepage shell, not an authorization-server metadata document
- path: /.well-known/api-catalog             # RFC 9727
  status: 200
  real: false
  note: returned SPA homepage shell, not an API catalog
- path: /.well-known/ai-plugin.json
  status: 200
  real: false
  note: returned SPA homepage shell, not a plugin manifest