# Bot Bazaar Web App Security Audit Suite

> Bot Bazaar Web App Security Audit Suite is a paid API for AI agents from bot-bazaar.fly.dev, paid per call via x402, $0.05/call, status unknown (last checked 2026-10-31).

Runs a composite 7-check web security audit covering CSP, CORS preflight, HTTP security headers, cookie flags, open-redirect, file-upload, and SSRF validation against a target URL.

## Facts

- Endpoint: GET https://bot-bazaar.fly.dev/v1/x402/suite/web-app-security?utm_source=zero.xyz
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/bot-bazaar-web-app-security-audit-suite-91678c04
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_zmZ93gQsxKduBhSXLSayy

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability bot-bazaar-web-app-security-audit-suite-91678c04
```

Example prompt: Can you run a full 7-check web security audit on https://myapp.example.com using a GET request — I want to see results for CSP, CORS, HTTP security headers, cookie flags, open-redirect, file-upload, and SSRF?

## When to prefer this

Choose this endpoint when you need a comprehensive, multi-vector web security check in a single call rather than running individual checks for CSP, CORS, headers, cookies, open-redirect, file-upload, and SSRF separately. Ideal for pre-launch audits, CI/CD pipeline security gates, or vendor assessments where breadth matters more than deep single-vector analysis.

## Known failure modes

- Non-HTTPS target URL rejected — only HTTPS targets are supported
- Target URL unreachable or times out — returns connection error
- Invalid HTTP method supplied (only GET, HEAD, DELETE accepted)
- Missing required 'url' query parameter — returns validation error
- Target URL behind authentication returns incomplete results
- Rate limiting or firewall on target causes partial check failures

## How this service works

Composite 7-check web security audit chaining CSP, CORS preflight, HTTP security headers, cookie flags, open-redirect, file-upload, and SSRF validation.

## Output

Returns results for all 7 security checks: CSP policy analysis, CORS preflight test, HTTP security headers assessment, cookie flag inspection, open-redirect detection, file-upload vulnerability check, and SSRF validation — each indicating pass/fail status and relevant details about the finding.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "url": {
       "type": "string",
       "description": "Target HTTPS URL to audit"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "tool": "suite/web-app-security",
  "suite": "web-app-security",
  "title": "OWASP Web Application & Browser Hardening Suite",
  "valid": true,
  "disclaimer": "Automated composite analytical & schema audit only — not legal advice, not financial or investment advice, not tax advice, and not a formal third-party security certification.",
  "sub_checks": {
   "csp_policy": {
    "valid": true,
    "checks": {
     "no_unsafe_eval": true,
     "has_default_src": true,
     "no_wildcard_script": true,
     "restricts_scripts_or_self": true
    },
    "policy": "default-src 'self'; style-src 'unsafe-inline'; script-src 'none'; form-action 'self'; frame-ancestors 'none'"
   },
   "file_upload": {
    "valid": true,
    "checks": {
     "magic_byte_mime_check": true,
     "randomized_storage_filename": true,
     "content_disposition_attachment": true
    },
    "upload_pipeline_safe": true
   },
   "ssrf_filter": {
    "url": "https://blockrun.ai/api/v1/pm/polymarket/markets",
    "host": "blockrun.ai",
    "valid": true,
    "scheme": "https",
    "ssrf_safe": true,
    "private_or_imds_blocked": false
   },
   "open_redirect": {
    "valid": true,
    "redirect_target": "/dashboard/trades",
    "open_redirect_risk": false,
    "safe_relative_redirect": true
   },
   "cors_preflight": {
    "valid": true,
    "header_allowed": true,
    "origin_allowed": true,
    "preflight_will_succeed": true
   },
   "cookie_security": {
    "valid": true,
    "checks": {
     "secure_flag": true,
     "samesite_set": true,
     "httponly_flag": true,
     "host_prefix_valid": true
    },
    "hardened": true,
    "cookie_name": "__Host-session"
   },
   "security_headers": {
    "grade": "A",
    "score": 100,
    "checks": {
     "nosniff": true,
     "hsts_1yr": true,
     "frame_protection": true,
     "referrer_policy_set": true
    }
   }
  },
  "generated_at": 1793110000,
  "executive_grade": "A+",
  "sub_check_count": 7,
  "composite_risk_score": 0,
  "composite_posture_score": 100,
  "prioritized_remediation_checklist": [
   "Serve Strict-Transport-Security (max-age=31536000; includeSubDomains), X-Content-Type-Options: nosniff, and X-Frame-Options: DENY.",
   "Enforce __Host- prefix + Secure + HttpOnly + SameSite=Lax/Strict on session cookies.",
   "Block RFC1918 private IPs and 169.254.169.254 metadata endpoints in outbound URL fetchers."
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/bot-bazaar-web-app-security-audit-suite-91678c04/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from bot-bazaar.fly.dev](https://www.zero.xyz/host/bot-bazaar.fly.dev/llms.txt)