# Proof QuickScan Config Security Scanner

> Proof QuickScan Config Security Scanner is a paid API for AI agents from qaegxjxaavxdqihfgzhr.supabase.co, paid per call via x402, $0.03/call, status unknown (last checked 2026-09-14).

Runs a bounded, deterministic preflight scan of supplied content or configuration for common security issues including private keys, secret assignments, permissive CORS, debug mode, insecure HTTP, and invalid JSON.

## Facts

- Endpoint: GET https://qaegxjxaavxdqihfgzhr.supabase.co/functions/v1/proof-quickscan-x402/QUICKSCAN_CONFIG_SCAN
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/proof-quickscan-config-security-scanner-9bf27fc8
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ZrWTKgK6QeyNt556CdXHi

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability proof-quickscan-config-security-scanner-9bf27fc8
```

Example prompt: Can you do a quick preflight security scan on this config file content and tell me if there are any exposed private keys, hardcoded secrets, permissive CORS settings, debug mode flags, insecure HTTP URLs, or invalid JSON? Here's the content: [paste config here]

## When to prefer this

Choose this endpoint when you need a fast, cheap, deterministic preflight check for the most common configuration security mistakes — leaked keys, secrets in plaintext, CORS misconfigurations, debug flags, and HTTP-not-HTTPS issues — before deploying or committing. It is not a replacement for a full SAST or penetration test, but is ideal for lightweight CI gates, automated pre-commit hooks, or agent-driven config review workflows where speed and cost matter.

## Known failure modes

- Content exceeds 200,000 character limit — scan rejected
- Malformed input schema causes 400 error
- SHA-256 mismatch if expected_sha256 provided but content differs
- Payment of $0.03 USDC not fulfilled — 402 response
- Empty or null content field returns no meaningful findings
- Ambiguous format field may reduce scan accuracy

## How this service works

Run a bounded deterministic preflight scan for possible private keys, secret assignments, permissive CORS, debug mode, insecure HTTP, and invalid JSON. Not a comprehensive security audit.

## Output

Returns a structured set of findings from the deterministic scan, indicating which security issues (if any) were detected: presence of private key patterns, secret variable assignments, overly permissive CORS headers, debug mode indicators, insecure HTTP URLs, and JSON validity status. Not a full penetration test or comprehensive audit — results are bounded to the specific checks listed.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "claim": {
   "type": "string",
   "maxLength": 20000
  },
  "format": {
   "type": "string"
  },
  "content": {
   "type": "string",
   "maxLength": 200000
  },
  "evidence": {},
  "expected_sha256": {
   "type": "string"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/proof-quickscan-config-security-scanner-9bf27fc8/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from qaegxjxaavxdqihfgzhr.supabase.co](https://www.zero.xyz/host/qaegxjxaavxdqihfgzhr.supabase.co/llms.txt)