generated: '2026-08-27'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + OpenAPI hosts (0-working/probe-domain-security.py,
  then hand-verified with curl -I on each host)
note: >-
  probe-domain-security.py recorded hsts: null for api.pexafy.com and did not visit
  pexafy.com or mcp.pexafy.com. A direct HEAD to each host returned
  "strict-transport-security: max-age=31536000; includeSubDomains" on all four, so the
  hsts values below are the observed ones. Every host is fronted by Cloudflare in front
  of Caddy.
hosts:
- host: pexafy.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Nov 17 03:58:49 2026 GMT
  cert_issuer: Google Trust Services WE1
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
- host: api.pexafy.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct  8 08:31:23 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
- host: docs.pexafy.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct  8 08:31:23 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
- host: mcp.pexafy.com
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct  8 08:31:23 2026 GMT
  cert_issuer: Let's Encrypt YE1
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
domains:
- domain: pexafy.com
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: none
response_headers_observed:
  source: GET https://api.pexafy.com/health and GET https://api.pexafy.com/api/v1/search/photos (401)
  headers:
  - content-security-policy: "default-src 'none'; frame-ancestors 'none'"
  - permissions-policy: "camera=(), microphone=(), geolocation=()"
  - referrer-policy: strict-origin-when-cross-origin
  - x-content-type-options: nosniff
  - x-frame-options: DENY
gaps:
- No DNSSEC on pexafy.com.
- No CAA records on pexafy.com.
- DMARC policy is p=none (monitor only), not quarantine or reject.
- No /.well-known/security.txt served on any host.