{
  "schemaVersion": "1.1",
  "target": {
    "id": "target_bxss.me",
    "hostname": "bxss.me",
    "unicodeHostname": "bxss.me",
    "canonicalUrl": "https://bxss.me/"
  },
  "checkId": "chk_0mv9iw7fxe27f8ea09b",
  "consensus": {
    "regionsConfigured": 1,
    "regionsReporting": 1,
    "unavailableRegions": [],
    "counts": {
      "up": 1,
      "reachable_restricted": 0,
      "degraded": 0,
      "down": 0,
      "inconclusive": 0
    },
    "regions": [
      {
        "region": "eu-central",
        "classification": "up",
        "reason": "http_success",
        "httpStatus": 200,
        "durationMs": 714
      }
    ],
    "classification": "up",
    "reachability": "reachable",
    "reason": "single_region",
    "summary": "bxss.me is up: it answered our probe normally (HTTP 200)."
  },
  "observation": {
    "id": "obs_0mv9iw7fx7fcf1ced3e",
    "observedAt": "2026-10-15T12:36:33.837Z",
    "vantage": {
      "region": "eu-central",
      "scope": "single-server-probe"
    },
    "reachability": "reachable",
    "classification": "up",
    "reason": "http_success",
    "summary": "bxss.me is up: it answered our probe normally (HTTP 200).",
    "dns": {
      "resolved": true,
      "durationMs": 3,
      "addresses": [
        "2600:1f14:da0:f001:14c9:2f95:b0e2:3e3c",
        "54.214.14.19"
      ],
      "error": null
    },
    "tls": {
      "attempted": true,
      "valid": true,
      "protocol": "TLSv1.2",
      "issuer": "Gandi SAS / GandiCert",
      "validTo": "2026-12-03T23:59:59.000Z",
      "daysRemaining": 49,
      "error": null
    },
    "http": {
      "method": "GET",
      "status": 200,
      "durationMs": 714,
      "redirectCount": 0,
      "finalUrl": "https://bxss.me/",
      "access": "normal",
      "httpVersion": "1.1",
      "hops": [
        {
          "url": "https://bxss.me/",
          "status": 200,
          "durationMs": 714,
          "location": null
        }
      ],
      "error": null
    },
    "headers": {
      "response": {
        "connection": "close",
        "content-encoding": "gzip",
        "content-type": "text/html",
        "date": "Thu, 15 Oct 2026 12:36:34 GMT",
        "server": "nginx",
        "transfer-encoding": "chunked"
      },
      "findings": [
        {
          "id": "hsts",
          "header": "Strict-Transport-Security",
          "present": false,
          "value": null,
          "severity": "warning",
          "summary": "Missing. Browsers may still try plain HTTP first; HSTS tells them to always use HTTPS."
        },
        {
          "id": "csp",
          "header": "Content-Security-Policy",
          "present": false,
          "value": null,
          "severity": "warning",
          "summary": "Missing. A CSP limits which scripts can run and is a strong defence against cross-site scripting."
        },
        {
          "id": "xcto",
          "header": "X-Content-Type-Options",
          "present": false,
          "value": null,
          "severity": "warning",
          "summary": "Missing or not \"nosniff\". Browsers may MIME-sniff responses."
        },
        {
          "id": "framing",
          "header": "X-Frame-Options",
          "present": false,
          "value": null,
          "severity": "info",
          "summary": "No X-Frame-Options or CSP frame-ancestors: other sites may embed this page in a frame (clickjacking risk)."
        },
        {
          "id": "referrer",
          "header": "Referrer-Policy",
          "present": false,
          "value": null,
          "severity": "info",
          "summary": "Not set; browsers default to strict-origin-when-cross-origin, which is reasonable."
        },
        {
          "id": "permissions",
          "header": "Permissions-Policy",
          "present": false,
          "value": null,
          "severity": "info",
          "summary": "Not set; browser features follow defaults. Optional hardening."
        },
        {
          "id": "cache",
          "header": "Cache-Control",
          "present": false,
          "value": null,
          "severity": "info",
          "summary": "Not set; caches will use heuristics based on Last-Modified/Expires."
        },
        {
          "id": "validators",
          "header": "ETag",
          "present": false,
          "value": null,
          "severity": "info",
          "summary": "No ETag or Last-Modified: browsers cannot cheaply revalidate cached copies."
        },
        {
          "id": "vary",
          "header": "Vary",
          "present": false,
          "value": null,
          "severity": "info",
          "summary": "No Vary header; caches treat all requests for this URL the same."
        },
        {
          "id": "compression",
          "header": "Content-Encoding",
          "present": true,
          "value": "gzip",
          "severity": "good",
          "summary": "Response is compressed (gzip)."
        },
        {
          "id": "server",
          "header": "Server",
          "present": true,
          "value": "nginx",
          "severity": "good",
          "summary": "No software version numbers disclosed."
        }
      ]
    }
  },
  "regions": [
    {
      "id": "obs_0mv9iw7fx7fcf1ced3e",
      "observedAt": "2026-10-15T12:36:33.837Z",
      "vantage": {
        "region": "eu-central",
        "scope": "single-server-probe"
      },
      "reachability": "reachable",
      "classification": "up",
      "reason": "http_success",
      "summary": "bxss.me is up: it answered our probe normally (HTTP 200).",
      "dns": {
        "resolved": true,
        "durationMs": 3,
        "addresses": [
          "2600:1f14:da0:f001:14c9:2f95:b0e2:3e3c",
          "54.214.14.19"
        ],
        "error": null
      },
      "tls": {
        "attempted": true,
        "valid": true,
        "protocol": "TLSv1.2",
        "issuer": "Gandi SAS / GandiCert",
        "validTo": "2026-12-03T23:59:59.000Z",
        "daysRemaining": 49,
        "error": null
      },
      "http": {
        "method": "GET",
        "status": 200,
        "durationMs": 714,
        "redirectCount": 0,
        "finalUrl": "https://bxss.me/",
        "access": "normal",
        "httpVersion": "1.1",
        "hops": [
          {
            "url": "https://bxss.me/",
            "status": 200,
            "durationMs": 714,
            "location": null
          }
        ],
        "error": null
      },
      "headers": {
        "response": {
          "connection": "close",
          "content-encoding": "gzip",
          "content-type": "text/html",
          "date": "Thu, 15 Oct 2026 12:36:34 GMT",
          "server": "nginx",
          "transfer-encoding": "chunked"
        },
        "findings": [
          {
            "id": "hsts",
            "header": "Strict-Transport-Security",
            "present": false,
            "value": null,
            "severity": "warning",
            "summary": "Missing. Browsers may still try plain HTTP first; HSTS tells them to always use HTTPS."
          },
          {
            "id": "csp",
            "header": "Content-Security-Policy",
            "present": false,
            "value": null,
            "severity": "warning",
            "summary": "Missing. A CSP limits which scripts can run and is a strong defence against cross-site scripting."
          },
          {
            "id": "xcto",
            "header": "X-Content-Type-Options",
            "present": false,
            "value": null,
            "severity": "warning",
            "summary": "Missing or not \"nosniff\". Browsers may MIME-sniff responses."
          },
          {
            "id": "framing",
            "header": "X-Frame-Options",
            "present": false,
            "value": null,
            "severity": "info",
            "summary": "No X-Frame-Options or CSP frame-ancestors: other sites may embed this page in a frame (clickjacking risk)."
          },
          {
            "id": "referrer",
            "header": "Referrer-Policy",
            "present": false,
            "value": null,
            "severity": "info",
            "summary": "Not set; browsers default to strict-origin-when-cross-origin, which is reasonable."
          },
          {
            "id": "permissions",
            "header": "Permissions-Policy",
            "present": false,
            "value": null,
            "severity": "info",
            "summary": "Not set; browser features follow defaults. Optional hardening."
          },
          {
            "id": "cache",
            "header": "Cache-Control",
            "present": false,
            "value": null,
            "severity": "info",
            "summary": "Not set; caches will use heuristics based on Last-Modified/Expires."
          },
          {
            "id": "validators",
            "header": "ETag",
            "present": false,
            "value": null,
            "severity": "info",
            "summary": "No ETag or Last-Modified: browsers cannot cheaply revalidate cached copies."
          },
          {
            "id": "vary",
            "header": "Vary",
            "present": false,
            "value": null,
            "severity": "info",
            "summary": "No Vary header; caches treat all requests for this URL the same."
          },
          {
            "id": "compression",
            "header": "Content-Encoding",
            "present": true,
            "value": "gzip",
            "severity": "good",
            "summary": "Response is compressed (gzip)."
          },
          {
            "id": "server",
            "header": "Server",
            "present": true,
            "value": "nginx",
            "severity": "good",
            "summary": "No software version numbers disclosed."
          }
        ]
      }
    }
  ],
  "provenance": {
    "checkerVersion": "2026.10.0",
    "methodologyVersion": "1.0",
    "methodology": "https://headerlens.usefulweb.site/methodology"
  },
  "links": {
    "self": "https://headerlens.usefulweb.site/api/v1/status/bxss.me",
    "human": "https://headerlens.usefulweb.site/status/bxss.me",
    "history": "https://headerlens.usefulweb.site/api/v1/status/bxss.me/history",
    "methodology": "https://headerlens.usefulweb.site/api/v1/methodology"
  }
}