generated: '2026-08-11'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + OpenAPI hosts
hosts:
- host: weaveapi.dev
  https: true
  tls_version: TLSv1.3
  cert_expires: Nov  5 15:14:29 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: api.weaveapi.dev
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct 29 11:42:07 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
  hsts_correction_note: >-
    The automated probe recorded hsts: null for this host because api.weaveapi.dev answers HEAD / with
    a bare 404. Direct header inspection on 2026-08-11 confirms the header IS served on every response
    including the 404 and the 401: "strict-transport-security: max-age=31536000; includeSubDomains".
    Corrected from observed evidence.
domains:
- domain: weaveapi.dev
  dnssec: false
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: quarantine

findings:
  strengths:
    - TLS 1.3 on both the marketing host and the API host.
    - HSTS with a one-year max-age and includeSubDomains on both hosts.
    - SPF and DMARC published, with DMARC at p=quarantine.
    - >-
      Additional response hardening on the API host — x-content-type-options nosniff and
      referrer-policy strict-origin-when-cross-origin.
  gaps:
    - No DNSSEC on weaveapi.dev.
    - No CAA records — any public CA may issue for the domain.
    - DMARC is p=quarantine rather than p=reject.
    - Certificates are short-dated (Oct/Nov 2026) — normal for automated issuance, noted for currency.
  note: >-
    Transport posture is solid and is the strongest area of WeaveAPI's security surface. It stands in
    contrast to the application layer, where there is no security.txt, no vulnerability disclosure
    channel, no trust center and no published compliance program (see conformance/ and well-known/).

x-evidence:
  - url: https://api.weaveapi.dev/v1/models
    http_status: 401
    header_observed: 'strict-transport-security: max-age=31536000; includeSubDomains'
  - url: https://weaveapi.dev/
    http_status: 200
    header_observed: 'strict-transport-security: max-age=31536000; includeSubDomains'