generated: '2026-07-28'
method: probed
source: >-
  live DNS/TLS/HTTP probes of every apis.yml host and every OpenAPI servers[] host
  (0-working/probe-domain-security.py, plus manual openssl/dig probes of the two OpenTravel-run
  service hosts the automated pass did not reach)
hosts:
- host: opentravel.org
  role: main website, MCP server, OAuth 2.1 authorization server
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep  9 21:25:29 2026 GMT
  hsts: true
  hsts_max_age: 63072000
- host: www.opentraveldevelopersnetwork.com
  role: OpenTravel Developers Network (ODN) developer portal
  https: true
  tls_version: TLSv1.3
  cert_issuer: "Let's Encrypt (CN=YR1)"
  cert_expires: Sep 21 08:46:49 2026 GMT
  hsts: false
- host: opentravelmodel.net
  role: OTM Library Repository console
  https: true
  tls_version: TLSv1.3
  cert_issuer: GlobalSign GCC R6 AlphaSSL CA 2025
  cert_expires: Oct 17 16:01:04 2026 GMT
  hsts: false
- host: 127.0.0.1
  role: placeholder host declared by the published Swagger 2.0 contracts
  https: false
  note: >-
    Not a real host. Six of the eight published documents declare host 127.0.0.1 and two declare
    example.com, and every one declares `schemes: [http]`. Implementers must supply their own
    host and serve over HTTPS; the artifact does not say so.
domains:
- domain: opentravel.org
  dnssec: false
  caa: []
  spf: true
  dmarc: false
- domain: opentraveldevelopersnetwork.com
  dnssec: false
  caa: []
  spf: false
  dmarc: false
- domain: opentravelmodel.net
  dnssec: false
  caa: []
  spf: true
  spf_record: 'v=spf1 ip4:3.135.211.37 +a +mx ~all'
  dmarc: false
observations:
- >-
  All three OpenTravel-operated hosts negotiate TLS 1.3 with valid certificates.
- >-
  HSTS is set only on opentravel.org (max-age 63072000, two years). Neither the developer portal
  nor the OTM repository console — both of which take a username and password — sends it.
- >-
  No domain publishes DNSSEC or a CAA record.
- >-
  No domain publishes DMARC, so there is no policy on mail spoofing opentravel.org,
  opentraveldevelopersnetwork.com or opentravelmodel.net. opentravel.org and opentravelmodel.net
  publish SPF; opentraveldevelopersnetwork.com publishes neither.
vulnerability_disclosure:
  published: false
  probed: '2026-07-28'
  detail: >-
    No vulnerability disclosure program and no trust center exist. /.well-known/security.txt
    returns a real nginx 404 on both opentravel.org and opentraveldevelopersnetwork.com.
    /security/, /responsible-disclosure/, /vulnerability-disclosure/, /trust/ and /compliance/
    on opentravel.org all return the WordPress soft-404 homepage (identical 190,291-byte body,
    zero disclosure or certification keywords). trust.opentravel.org and security.opentravel.org
    do not resolve. No HackerOne, Bugcrowd or Intigriti program was found. No SOC 2, ISO 27001,
    PCI DSS, HIPAA or FedRAMP claim appears anywhere on the site. Recorded as a verified
    negative — no security/ vulnerability-disclosure or trust-center artifact was written,
    because there is nothing to record.