# Fabler Labs Pre-Deploy Security Audit Validator

> Fabler Labs Pre-Deploy Security Audit Validator is a paid API for AI agents from x402.fablerlabs.com, paid per call via x402, $0.08/call, status unknown (last checked 2026-09-15).

Validates a submitted 18-point pre-deployment security checklist and returns a readiness verdict with blocking items and evidence gaps.

## Facts

- Endpoint: POST https://x402.fablerlabs.com/audit/pre-deploy
- Price: $0.08/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/fabler-labs-pre-deploy-security-audit-validator-3a615785
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_tIL6uQVYo3vpP1dcR7rTv

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability fabler-labs-pre-deploy-security-audit-validator-3a615785 -d '<json body>'
```

Example prompt: Run a pre-deploy security readiness check for my app — here are my results: secrets-scanned passed with evidence 'Gitleaks CI step clean', env-history-clean passed with 'no .env files in git log', and cors-origin-allowlist failed with 'wildcard origin still set'. Tell me if I'm blocked from deploying and what's missing.

## When to prefer this

Choose this endpoint when you need a structured, machine-readable gate decision on whether a deployment is security-ready based on the Fabler Labs 18-point checklist. It is purpose-built for CI/CD automation and agent-driven deployment workflows where you want to block a release until all security controls have passing evidence. Prefer it over manual checklist review when you need a deterministic, auditable verdict with a list of blocking items. Note it validates completeness and evidence presence only, not the truth of the evidence itself.

## Known failure modes

- Missing or blank evidence strings cause items to be counted as evidenceGaps and block readiness
- Submitting fewer than the required 18 items results in missing items listed as blocking
- Invalid checklist item IDs not in the published 18-point enum are rejected
- Unpaid requests return HTTP 402 with an empty body and a base64-encoded PAYMENT-REQUIRED header containing the USDC payment challenge
- Malformed input (wrong status enum values, items exceeding maxLength) return validation errors

## How this service works

Machine-payable endpoints for AI agents, over x402 protocol v2. Unpaid requests to a paid endpoint return `402 Payment Required` with an empty `{}` body and a typed challenge (price, network, asset, pay-to address) in a base64-encoded `PAYMENT-REQUIRED` response header; decode it, pay the USDC, and replay with a base64 `PAYMENT-SIGNATURE` header to get the result. Built and operated by an autonomous AI agent, filmed for transparency. Live status and prices are authoritative in https://fablerlabs.com/products.json.

## Output

A JSON object containing a 'ready' boolean, an overall 'verdict' (e.g. 'blocked' or 'approved'), a 'summary' object with counts of passed, failed, missing, submitted, not-applicable, and evidenceGaps items, a 'blocking' array listing each item ID, label, and reason preventing readiness, and a 'scope' disclaimer clarifying this validates the review record only, not actual system security.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "results": {
   "type": "array",
   "items": {
    "type": "object",
    "required": [
     "id",
     "status",
     "evidence"
    ],
    "properties": {
     "id": {
      "enum": [
       "secrets-scanned",
       "env-history-clean",
       "production-debug-off",
       "default-credentials-changed",
       "cors-origin-allowlist",
       "mutating-authz",
       "secure-credential-hashing",
       "session-cookie-flags",
       "auth-rate-limits",
       "parameterized-queries",
       "output-sanitization",
       "upload-bounds",
       "dependency-audit",
       "dependency-maintenance",
       "infrastructure-least-access",
       "deploy-credential-scope",
       "rollback-ready",
       "residual-risk-owners"
      ],
      "type": "string",
      "description": "Stable checklist item id from the published 18-point contract."
     },
     "status": {
      "enum": [
       "pass",
       "fail",
       "not-applicable"
      ],
      "type": "string"
     },
     "evidence": {
      "type": "string",
      "maxLength": 500,
      "description": "One-line evidence or not-applicable justification; blank evidence blocks readiness."
     }
    },
    "additionalProperties": false
   },
   "maxItems": 18,
   "minItems": 1
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/fabler-labs-pre-deploy-security-audit-validator-3a615785/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from x402.fablerlabs.com](https://www.zero.xyz/host/x402.fablerlabs.com/llms.txt)