OBSERVE · CONNECT · UNDERSTAND
FR EN
Read a domain

PUBLIC DOMAIN DOSSIER

repo.quaric.org

What is observed, how to verify it and what changed

8 public observations are documented in this dossier.

4 structuring public dependencies are visible.

8 useful changes are retained since the previous reading.

2 points still require confirmation or cannot be observed from outside.

Measured 2026-09-06 01:58 UTC First observation 2026-09-04 19:30 UTC Latest observation 2026-09-06 01:58 UTC
History Compare JSON Markdown

TIME

What changed over time

Compared with the previous stored reading

7Appeared
1Modified
35Stable
0Disappeared
New

Canary signal

New

Csp evidence

New

Dnssec evidence

New

Mail transport evidence

New

Modern transport evidence

Modified

Module finding

SHORT VIEW

Four readings before the detail

The 12 historical angles remain available below for deeper inspection.

Identity & governance

  • ObservedOpenpgp
  • ObservedCanary detection1
  • Not observable from outsideOrigin host

Infrastructure & transport

  • Not testedPost quantum tls
  • ObservedTls issuerC = US, O = Let's Encrypt, CN = YE2

Mail & trust

  • ObservedSpf policymissing

Dependencies & exposure

  • ObservedDepends on providerCloudflare
  • ObservedDepends on providerLinkedIn
  • ObservedDepends on providerstatic.cloudflareinsights.com

Explanatory record

What Scanapse understands about this domain

Scanapse has enough material to describe 11 of 12 knowledge angles for repo.quaric.org. 2 questions remain open with the available public evidence.

Measured on 2026-09-06 01:58 UTC Engine 2.9.2.1

Read the domain folder

The key points for reading this domain folder

Four key points to understand what Scanapse observed, what can reasonably be retained, and what still needs verification.

Key points

Worth looking at today

Only a few items are shown when they add something genuinely useful to the reading.

DEPENDENCIES

Critical function concentration

Cloudflare is associated with 2 critical function(s) or observations in the visible scope.

This concentration is descriptive. It does not prove a future outage or the absence of failover mechanisms invisible to the scan.

Territorial and legal context

Which legal context can reasonably be retained

Scanapse distinguishes established, probable and to-confirm jurisdiction and always explains which clues support the reading.

To confirm To confirm

Why this context appears

  • No sufficiently reliable public jurisdiction clue was found in the report

What this does not establish

  • Technical hosting, IP addresses, ASNs and CDN locations do not establish the applicable legal jurisdiction by themselves.
  • The applicable jurisdiction requires additional public or organisational evidence.

Regulatory frameworks

Useful texts for this context

References are selected from the observed context. Their presence explains potential relevance, never automatic compliance.

To confirmTo determine

Regulatory context to determine

The available public evidence does not establish a sufficiently reliable jurisdiction for automatic legal contextualisation.

This section provides documentary context. It is not legal advice, certification or a compliance verdict.

Trajectory

Useful changes since the previous reading

Only differences that help interpretation are highlighted. Stable or purely technical variations remain available in the evidence.

Changed

Canary signal

Not observedStructured value changed

Changed

Csp evidence

Not observedStructured value changed

Changed

Dnssec evidence

Not observedStructured value changed

Changed

Mail transport evidence

Not observedStructured value changed

12 knowledge angles

12 angles to understand the domain

Each angle explains what is known, why it matters, how to read it, its purpose and its limits.

01
Documented Change observed

Domain identity

Public evidence provides enough material to document this angle

Angle 01

Domain identity

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

7evidence
8changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
7
Signals
0
Changes
8
dns_address dns dbd91a8105c953331b6f955d8369efd160a59ce5ebace3569426dfb9e73f5cdb 
"2606:4700:3032::6815:6f0"
dns_address dns 4c79417eba9dcd122e62d9ca495bea7bcf308a6a39cc96fe9280b60d20c95c78 
"104.21.6.240"
module_finding dns 03ad054b3bc28aa961513c15a3b0d622fb4009fe086bcbefea644c299f884e0a 
{
    "evidence": {
        "reason": "No external validating resolver is used; cryptographic validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
dns_address dns b1f81cbd624e70ab7a8e66a0081c325af801e44eacbff27be3a21ca2f9680157 
"2606:4700:3037::ac43:8779"
dns_address dns ebde5d8b7b51e8bf529c2d8a2cdcb7aae935facd03ed466d88db7a0a12c205e6 
"172.67.135.121"
module_finding dns d9135142bbd2eaaa8148117103ff9ecab432666c3f35676f4e960aee4cf3de2a 
{
    "evidence": [],
    "severity": "high"
}
module_finding dns b7d3abe751eef9e718ae61e88eb60d79d28a8fd7986f13dc41f61eb3c3970d84 
{
    "evidence": null,
    "severity": "low"
}
02
Documented Change observed

Infrastructure

Public evidence provides enough material to document this angle

Angle 02

Infrastructure

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

14evidence
11changes
2open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
14
Signals
2
Changes
11

Unknowns and limitations

2 items still require qualification

dns_address dns dbd91a8105c953331b6f955d8369efd160a59ce5ebace3569426dfb9e73f5cdb 
"2606:4700:3032::6815:6f0"
module_finding sovereignty 06d8ae5f0d6c408ef917cd319def558af5af875bf1b3392e436703bab99d2d4b 
{
    "evidence": [
        "Cloudflare",
        "LinkedIn"
    ],
    "severity": "high"
}
dependency_provider dependencies 20753772ee6b35ea28a48819fe1cd1484a81e25949d5f7fdf8bbec6693843231 
{
    "critical": true,
    "hosts": [
        "cloudflare.com"
    ],
    "id": "cloudflare",
    "known": true,
    "name": "Cloudflare",
    "observation_count": 1,
    "services": [
        "cdn",
        "security"
    ],
    "tracker": false
}
dns_address dns 4c79417eba9dcd122e62d9ca495bea7bcf308a6a39cc96fe9280b60d20c95c78 
"104.21.6.240"
dependency_provider dependencies 43943d20704294616895eb3216a93dc23a59b78d3772570dec7cba878c20e6ac 
{
    "critical": false,
    "hosts": [
        "0bla.com"
    ],
    "id": "host-d60d939674d6",
    "known": false,
    "name": "0bla.com",
    "observation_count": 1,
    "services": [
        "unknown"
    ],
    "tracker": false
}
module_finding dns 03ad054b3bc28aa961513c15a3b0d622fb4009fe086bcbefea644c299f884e0a 
{
    "evidence": {
        "reason": "No external validating resolver is used; cryptographic validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
dependency_provider dependencies 9542f7cec5d1b7a7918d9861593b80617d79c1975f9cc0a3ba662c9ea849230f 
{
    "critical": false,
    "hosts": [
        "static.cloudflareinsights.com"
    ],
    "id": "host-d15afad5fd0c",
    "known": false,
    "name": "static.cloudflareinsights.com",
    "observation_count": 1,
    "services": [
        "unknown"
    ],
    "tracker": false
}
dns_address dns b1f81cbd624e70ab7a8e66a0081c325af801e44eacbff27be3a21ca2f9680157 
"2606:4700:3037::ac43:8779"
module_finding dependencies 59da5cf60b4f12c5b1db37ae3a43ee4773e1e10c9602ee5b8264f7cc1af8fe55 
{
    "evidence": [
        "0bla.com",
        "static.cloudflareinsights.com"
    ],
    "severity": "medium"
}
dns_address dns ebde5d8b7b51e8bf529c2d8a2cdcb7aae935facd03ed466d88db7a0a12c205e6 
"172.67.135.121"
module_finding dns d9135142bbd2eaaa8148117103ff9ecab432666c3f35676f4e960aee4cf3de2a 
{
    "evidence": [],
    "severity": "high"
}
dependency_provider dependencies af2793caac2a5db95f4655d9059f2c2ed30115d24d6e1ed9186ab57c5b337c25 
{
    "critical": false,
    "hosts": [
        "www.linkedin.com"
    ],
    "id": "linkedin",
    "known": true,
    "name": "LinkedIn",
    "observation_count": 1,
    "services": [
        "advertising",
        "social"
    ],
    "tracker": true
}
module_finding dns b7d3abe751eef9e718ae61e88eb60d79d28a8fd7986f13dc41f61eb3c3970d84 
{
    "evidence": null,
    "severity": "low"
}
module_finding sovereignty 3cf5c7bf6da6751daa71fc1e0c09a1ef9967d3a6b0c3777115e6407b45b5eb23 
{
    "evidence": [
        "0bla.com",
        "static.cloudflareinsights.com"
    ],
    "severity": "medium"
}
03
Documented Change observed

Encryption and transport

Public evidence provides enough material to document this angle

Angle 03

Encryption and transport

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

12evidence
7changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
12
Signals
0
Changes
7
http_header headers 41df472d11481594ad9e0ce5b48c0b64bd09d97e75e86fc9346e6e951bf6160d 
[
    "strict-origin-when-cross-origin"
]
http_header headers ee6b075b7b9506b65346d97e6d38bb0c8bfaeb7bc04ca703f53bed632d8475bc 
[
    "DENY"
]
tls_valid_to tls 8a5c37b8c15dfbd2d9a84ec20d4b888f4d978a06b020edcb535ed1e24a8a0a0f 
"2026-10-20T02:33:05+00:00"
http_header headers ba5b8b44d1563c24aa81a3a765996dc531e9ca5a426b99fb95e9abe58489af4e 
[
    "same-origin"
]
http_header headers fd38b3f7e94f49702bcf3bccc5b45060815a43fb225f6e58dca9c45e92f627f2 
[
    "nosniff"
]
http_header headers f38fe8ca9b3483adeb8d311afdcb9bd4ee9d99318b80c56d35d9dcf4d1a31d1c 
[
    "cloudflare"
]
http_header headers 2571f5b2f7b486e65cc54dd0a19746e41a6fc918c7f28cd2c90cbeef4ce08934 
[
    "default-src 'none'; script-src 'nonce-JOWl9XGV0kfGCP6iifM3aQ==' 'strict-dynamic'; style-src 'self' 'nonce-JOWl9XGV0kfGCP6iifM3aQ=='; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; manifest-src 'self'"
]
http_header headers 2936ff32eb12d742d7b3ba801e8cc1af09d7af6ad6d483a29506f491c84ca2fa 
[
    "max-age=63072000; includeSubDomains; preload"
]
http_header headers 8a8ed21b62e6cc88282b7ad8cd79e05026a9a37470c8a6fa171dfac90fd2d998 
[
    "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
]
http_header headers 1bf3f36f270f0e142b0fda3fe6ad16fb165f2f80348981b8ac2161bf4ab80a02 
[
    "require-corp"
]
tls_issuer tls 7055faabfb704a1d0b7acc82ed57ad7517c7d15aa6e4b4fec1d732f0b448e78c 
"C = US, O = Let's Encrypt, CN = YE2"
http_header headers 321a2b96962ad121ae5ebb57e31b15b98aff9c2806274adfa5a05d4087845603 
[
    "same-origin"
]
04
Documented Change observed

Mail and trust

Public evidence provides enough material to document this angle

Angle 04

Mail and trust

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

12evidence
6changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
12
Signals
0
Changes
6
dns_address dns dbd91a8105c953331b6f955d8369efd160a59ce5ebace3569426dfb9e73f5cdb 
"2606:4700:3032::6815:6f0"
dns_address dns 4c79417eba9dcd122e62d9ca495bea7bcf308a6a39cc96fe9280b60d20c95c78 
"104.21.6.240"
mail_policy_flag mail_trust c7f111d6bd69101e6453b11ee2cfd29e9bd59b1f04ab1826bf1f74991dc973d8 
false
module_finding dns 03ad054b3bc28aa961513c15a3b0d622fb4009fe086bcbefea644c299f884e0a 
{
    "evidence": {
        "reason": "No external validating resolver is used; cryptographic validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
mail_policy_flag mail_trust e6867c3da35d8b75e33155fad24ad09e64afbb5834785db46b2ba33a79420232 
false
spf_policy mail_trust 6c72031acf458f10651e9e4d28f71272e6767958361b540e38ffc0f0a4f63133 
"missing"
mail_policy_flag mail_trust b0176d15b6bd220d68ec2aa1c7d047f1deddb7540fb6eedf44b5f612d5280f1c 
false
dns_address dns b1f81cbd624e70ab7a8e66a0081c325af801e44eacbff27be3a21ca2f9680157 
"2606:4700:3037::ac43:8779"
dns_address dns ebde5d8b7b51e8bf529c2d8a2cdcb7aae935facd03ed466d88db7a0a12c205e6 
"172.67.135.121"
module_finding dns d9135142bbd2eaaa8148117103ff9ecab432666c3f35676f4e960aee4cf3de2a 
{
    "evidence": [],
    "severity": "high"
}
module_finding dns b7d3abe751eef9e718ae61e88eb60d79d28a8fd7986f13dc41f61eb3c3970d84 
{
    "evidence": null,
    "severity": "low"
}
module_finding mail_trust 8cc4764f7ed57c23650eaeac24c211493f7e4e18950d6c27f3bbc13389a8e5fc 
{
    "evidence": null,
    "severity": "info"
}
05
Documented Change observed

DNS and governance

Public evidence provides enough material to document this angle

Angle 05

DNS and governance

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

12evidence
8changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
12
Signals
0
Changes
8
dns_address dns dbd91a8105c953331b6f955d8369efd160a59ce5ebace3569426dfb9e73f5cdb 
"2606:4700:3032::6815:6f0"
dns_address dns 4c79417eba9dcd122e62d9ca495bea7bcf308a6a39cc96fe9280b60d20c95c78 
"104.21.6.240"
mail_policy_flag mail_trust c7f111d6bd69101e6453b11ee2cfd29e9bd59b1f04ab1826bf1f74991dc973d8 
false
module_finding dns 03ad054b3bc28aa961513c15a3b0d622fb4009fe086bcbefea644c299f884e0a 
{
    "evidence": {
        "reason": "No external validating resolver is used; cryptographic validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
mail_policy_flag mail_trust e6867c3da35d8b75e33155fad24ad09e64afbb5834785db46b2ba33a79420232 
false
spf_policy mail_trust 6c72031acf458f10651e9e4d28f71272e6767958361b540e38ffc0f0a4f63133 
"missing"
mail_policy_flag mail_trust b0176d15b6bd220d68ec2aa1c7d047f1deddb7540fb6eedf44b5f612d5280f1c 
false
dns_address dns b1f81cbd624e70ab7a8e66a0081c325af801e44eacbff27be3a21ca2f9680157 
"2606:4700:3037::ac43:8779"
dns_address dns ebde5d8b7b51e8bf529c2d8a2cdcb7aae935facd03ed466d88db7a0a12c205e6 
"172.67.135.121"
module_finding dns d9135142bbd2eaaa8148117103ff9ecab432666c3f35676f4e960aee4cf3de2a 
{
    "evidence": [],
    "severity": "high"
}
module_finding dns b7d3abe751eef9e718ae61e88eb60d79d28a8fd7986f13dc41f61eb3c3970d84 
{
    "evidence": null,
    "severity": "low"
}
module_finding mail_trust 8cc4764f7ed57c23650eaeac24c211493f7e4e18950d6c27f3bbc13389a8e5fc 
{
    "evidence": null,
    "severity": "info"
}
06
Documented Change observed

External dependencies

Public evidence provides enough material to document this angle

Angle 06

External dependencies

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

17evidence
7changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
17
Signals
2
Changes
7
dns_address dns dbd91a8105c953331b6f955d8369efd160a59ce5ebace3569426dfb9e73f5cdb 
"2606:4700:3032::6815:6f0"
module_finding sovereignty 06d8ae5f0d6c408ef917cd319def558af5af875bf1b3392e436703bab99d2d4b 
{
    "evidence": [
        "Cloudflare",
        "LinkedIn"
    ],
    "severity": "high"
}
dependency_provider dependencies 20753772ee6b35ea28a48819fe1cd1484a81e25949d5f7fdf8bbec6693843231 
{
    "critical": true,
    "hosts": [
        "cloudflare.com"
    ],
    "id": "cloudflare",
    "known": true,
    "name": "Cloudflare",
    "observation_count": 1,
    "services": [
        "cdn",
        "security"
    ],
    "tracker": false
}
dns_address dns 4c79417eba9dcd122e62d9ca495bea7bcf308a6a39cc96fe9280b60d20c95c78 
"104.21.6.240"
dependency_provider dependencies 43943d20704294616895eb3216a93dc23a59b78d3772570dec7cba878c20e6ac 
{
    "critical": false,
    "hosts": [
        "0bla.com"
    ],
    "id": "host-d60d939674d6",
    "known": false,
    "name": "0bla.com",
    "observation_count": 1,
    "services": [
        "unknown"
    ],
    "tracker": false
}
module_finding dns 03ad054b3bc28aa961513c15a3b0d622fb4009fe086bcbefea644c299f884e0a 
{
    "evidence": {
        "reason": "No external validating resolver is used; cryptographic validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
dependency_provider dependencies 9542f7cec5d1b7a7918d9861593b80617d79c1975f9cc0a3ba662c9ea849230f 
{
    "critical": false,
    "hosts": [
        "static.cloudflareinsights.com"
    ],
    "id": "host-d15afad5fd0c",
    "known": false,
    "name": "static.cloudflareinsights.com",
    "observation_count": 1,
    "services": [
        "unknown"
    ],
    "tracker": false
}
dns_address dns b1f81cbd624e70ab7a8e66a0081c325af801e44eacbff27be3a21ca2f9680157 
"2606:4700:3037::ac43:8779"
cookie privacy bbeaa411ea3bbb2992e06a5f54a19595857d9c00b72e24e3217ce7663acbb7ba 
{
    "http_only": true,
    "name": "quaric_lang",
    "same_site": "strict",
    "secure": true
}
module_finding dependencies 59da5cf60b4f12c5b1db37ae3a43ee4773e1e10c9602ee5b8264f7cc1af8fe55 
{
    "evidence": [
        "0bla.com",
        "static.cloudflareinsights.com"
    ],
    "severity": "medium"
}
dns_address dns ebde5d8b7b51e8bf529c2d8a2cdcb7aae935facd03ed466d88db7a0a12c205e6 
"172.67.135.121"
module_finding privacy 342568745889882df68150d30ed17b49d1f39bc3bf2c2b7fb1f5ccd60ec2979a 
{
    "evidence": [
        "LinkedIn"
    ],
    "severity": "medium"
}
module_finding dns d9135142bbd2eaaa8148117103ff9ecab432666c3f35676f4e960aee4cf3de2a 
{
    "evidence": [],
    "severity": "high"
}
dependency_provider dependencies af2793caac2a5db95f4655d9059f2c2ed30115d24d6e1ed9186ab57c5b337c25 
{
    "critical": false,
    "hosts": [
        "www.linkedin.com"
    ],
    "id": "linkedin",
    "known": true,
    "name": "LinkedIn",
    "observation_count": 1,
    "services": [
        "advertising",
        "social"
    ],
    "tracker": true
}
module_finding dns b7d3abe751eef9e718ae61e88eb60d79d28a8fd7986f13dc41f61eb3c3970d84 
{
    "evidence": null,
    "severity": "low"
}
module_finding sovereignty 3cf5c7bf6da6751daa71fc1e0c09a1ef9967d3a6b0c3777115e6407b45b5eb23 
{
    "evidence": [
        "0bla.com",
        "static.cloudflareinsights.com"
    ],
    "severity": "medium"
}
tracker_provider privacy 0e86ed9e34a266199fe7f935758c4fa0513438d438ad24d8c496501c730232eb 
"LinkedIn"
07
Documented Change observed

Observable technologies

Public evidence provides enough material to document this angle

Angle 07

Observable technologies

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

11evidence
1changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
11
Signals
0
Changes
1
http_header headers 41df472d11481594ad9e0ce5b48c0b64bd09d97e75e86fc9346e6e951bf6160d 
[
    "strict-origin-when-cross-origin"
]
http_header headers ee6b075b7b9506b65346d97e6d38bb0c8bfaeb7bc04ca703f53bed632d8475bc 
[
    "DENY"
]
http_header headers ba5b8b44d1563c24aa81a3a765996dc531e9ca5a426b99fb95e9abe58489af4e 
[
    "same-origin"
]
http_header headers fd38b3f7e94f49702bcf3bccc5b45060815a43fb225f6e58dca9c45e92f627f2 
[
    "nosniff"
]
http_header headers f38fe8ca9b3483adeb8d311afdcb9bd4ee9d99318b80c56d35d9dcf4d1a31d1c 
[
    "cloudflare"
]
http_header headers 2571f5b2f7b486e65cc54dd0a19746e41a6fc918c7f28cd2c90cbeef4ce08934 
[
    "default-src 'none'; script-src 'nonce-JOWl9XGV0kfGCP6iifM3aQ==' 'strict-dynamic'; style-src 'self' 'nonce-JOWl9XGV0kfGCP6iifM3aQ=='; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; manifest-src 'self'"
]
http_header headers 2936ff32eb12d742d7b3ba801e8cc1af09d7af6ad6d483a29506f491c84ca2fa 
[
    "max-age=63072000; includeSubDomains; preload"
]
http_header headers 8a8ed21b62e6cc88282b7ad8cd79e05026a9a37470c8a6fa171dfac90fd2d998 
[
    "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
]
http_header headers 1bf3f36f270f0e142b0fda3fe6ad16fb165f2f80348981b8ac2161bf4ab80a02 
[
    "require-corp"
]
technology technology 422649c9d6c4df30d0f7015877829ad25de80126d838c00277cd52f3dcdd930d 
{
    "name": "cloudflare",
    "version": "",
    "version_exposed": false
}
http_header headers 321a2b96962ad121ae5ebb57e31b15b98aff9c2806274adfa5a05d4087845603 
[
    "same-origin"
]
08
Documented Change observed

Public exposure

Public evidence provides enough material to document this angle

Angle 08

Public exposure

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

20evidence
1changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
20
Signals
0
Changes
1
http_header headers 41df472d11481594ad9e0ce5b48c0b64bd09d97e75e86fc9346e6e951bf6160d 
[
    "strict-origin-when-cross-origin"
]
module_finding sovereignty 06d8ae5f0d6c408ef917cd319def558af5af875bf1b3392e436703bab99d2d4b 
{
    "evidence": [
        "Cloudflare",
        "LinkedIn"
    ],
    "severity": "high"
}
http_header headers ee6b075b7b9506b65346d97e6d38bb0c8bfaeb7bc04ca703f53bed632d8475bc 
[
    "DENY"
]
http_header headers ba5b8b44d1563c24aa81a3a765996dc531e9ca5a426b99fb95e9abe58489af4e 
[
    "same-origin"
]
http_header headers fd38b3f7e94f49702bcf3bccc5b45060815a43fb225f6e58dca9c45e92f627f2 
[
    "nosniff"
]
http_header headers f38fe8ca9b3483adeb8d311afdcb9bd4ee9d99318b80c56d35d9dcf4d1a31d1c 
[
    "cloudflare"
]
module_finding dns 03ad054b3bc28aa961513c15a3b0d622fb4009fe086bcbefea644c299f884e0a 
{
    "evidence": {
        "reason": "No external validating resolver is used; cryptographic validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
cookie privacy bbeaa411ea3bbb2992e06a5f54a19595857d9c00b72e24e3217ce7663acbb7ba 
{
    "http_only": true,
    "name": "quaric_lang",
    "same_site": "strict",
    "secure": true
}
module_finding dependencies 59da5cf60b4f12c5b1db37ae3a43ee4773e1e10c9602ee5b8264f7cc1af8fe55 
{
    "evidence": [
        "0bla.com",
        "static.cloudflareinsights.com"
    ],
    "severity": "medium"
}
module_finding privacy 342568745889882df68150d30ed17b49d1f39bc3bf2c2b7fb1f5ccd60ec2979a 
{
    "evidence": [
        "LinkedIn"
    ],
    "severity": "medium"
}
http_header headers 2571f5b2f7b486e65cc54dd0a19746e41a6fc918c7f28cd2c90cbeef4ce08934 
[
    "default-src 'none'; script-src 'nonce-JOWl9XGV0kfGCP6iifM3aQ==' 'strict-dynamic'; style-src 'self' 'nonce-JOWl9XGV0kfGCP6iifM3aQ=='; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; manifest-src 'self'"
]
module_finding dns d9135142bbd2eaaa8148117103ff9ecab432666c3f35676f4e960aee4cf3de2a 
{
    "evidence": [],
    "severity": "high"
}
http_header headers 2936ff32eb12d742d7b3ba801e8cc1af09d7af6ad6d483a29506f491c84ca2fa 
[
    "max-age=63072000; includeSubDomains; preload"
]
http_header headers 8a8ed21b62e6cc88282b7ad8cd79e05026a9a37470c8a6fa171dfac90fd2d998 
[
    "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
]
module_finding dns b7d3abe751eef9e718ae61e88eb60d79d28a8fd7986f13dc41f61eb3c3970d84 
{
    "evidence": null,
    "severity": "low"
}
http_header headers 1bf3f36f270f0e142b0fda3fe6ad16fb165f2f80348981b8ac2161bf4ab80a02 
[
    "require-corp"
]
module_finding sovereignty 3cf5c7bf6da6751daa71fc1e0c09a1ef9967d3a6b0c3777115e6407b45b5eb23 
{
    "evidence": [
        "0bla.com",
        "static.cloudflareinsights.com"
    ],
    "severity": "medium"
}
tracker_provider privacy 0e86ed9e34a266199fe7f935758c4fa0513438d438ad24d8c496501c730232eb 
"LinkedIn"
module_finding mail_trust 8cc4764f7ed57c23650eaeac24c211493f7e4e18950d6c27f3bbc13389a8e5fc 
{
    "evidence": null,
    "severity": "info"
}
http_header headers 321a2b96962ad121ae5ebb57e31b15b98aff9c2806274adfa5a05d4087845603 
[
    "same-origin"
]
09
Documented Stable

Documentary trust

Public evidence provides enough material to document this angle

Angle 09

Documentary trust

Documented Stable

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

18evidence
0changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
18
Signals
0
Changes
0
http_header headers 41df472d11481594ad9e0ce5b48c0b64bd09d97e75e86fc9346e6e951bf6160d 
[
    "strict-origin-when-cross-origin"
]
module_finding sovereignty 06d8ae5f0d6c408ef917cd319def558af5af875bf1b3392e436703bab99d2d4b 
{
    "evidence": [
        "Cloudflare",
        "LinkedIn"
    ],
    "severity": "high"
}
http_header headers ee6b075b7b9506b65346d97e6d38bb0c8bfaeb7bc04ca703f53bed632d8475bc 
[
    "DENY"
]
http_header headers ba5b8b44d1563c24aa81a3a765996dc531e9ca5a426b99fb95e9abe58489af4e 
[
    "same-origin"
]
http_header headers fd38b3f7e94f49702bcf3bccc5b45060815a43fb225f6e58dca9c45e92f627f2 
[
    "nosniff"
]
http_header headers f38fe8ca9b3483adeb8d311afdcb9bd4ee9d99318b80c56d35d9dcf4d1a31d1c 
[
    "cloudflare"
]
module_finding dns 03ad054b3bc28aa961513c15a3b0d622fb4009fe086bcbefea644c299f884e0a 
{
    "evidence": {
        "reason": "No external validating resolver is used; cryptographic validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
module_finding dependencies 59da5cf60b4f12c5b1db37ae3a43ee4773e1e10c9602ee5b8264f7cc1af8fe55 
{
    "evidence": [
        "0bla.com",
        "static.cloudflareinsights.com"
    ],
    "severity": "medium"
}
module_finding privacy 342568745889882df68150d30ed17b49d1f39bc3bf2c2b7fb1f5ccd60ec2979a 
{
    "evidence": [
        "LinkedIn"
    ],
    "severity": "medium"
}
http_header headers 2571f5b2f7b486e65cc54dd0a19746e41a6fc918c7f28cd2c90cbeef4ce08934 
[
    "default-src 'none'; script-src 'nonce-JOWl9XGV0kfGCP6iifM3aQ==' 'strict-dynamic'; style-src 'self' 'nonce-JOWl9XGV0kfGCP6iifM3aQ=='; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; manifest-src 'self'"
]
module_finding dns d9135142bbd2eaaa8148117103ff9ecab432666c3f35676f4e960aee4cf3de2a 
{
    "evidence": [],
    "severity": "high"
}
http_header headers 2936ff32eb12d742d7b3ba801e8cc1af09d7af6ad6d483a29506f491c84ca2fa 
[
    "max-age=63072000; includeSubDomains; preload"
]
http_header headers 8a8ed21b62e6cc88282b7ad8cd79e05026a9a37470c8a6fa171dfac90fd2d998 
[
    "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
]
module_finding dns b7d3abe751eef9e718ae61e88eb60d79d28a8fd7986f13dc41f61eb3c3970d84 
{
    "evidence": null,
    "severity": "low"
}
http_header headers 1bf3f36f270f0e142b0fda3fe6ad16fb165f2f80348981b8ac2161bf4ab80a02 
[
    "require-corp"
]
module_finding sovereignty 3cf5c7bf6da6751daa71fc1e0c09a1ef9967d3a6b0c3777115e6407b45b5eb23 
{
    "evidence": [
        "0bla.com",
        "static.cloudflareinsights.com"
    ],
    "severity": "medium"
}
module_finding mail_trust 8cc4764f7ed57c23650eaeac24c211493f7e4e18950d6c27f3bbc13389a8e5fc 
{
    "evidence": null,
    "severity": "info"
}
http_header headers 321a2b96962ad121ae5ebb57e31b15b98aff9c2806274adfa5a05d4087845603 
[
    "same-origin"
]
10
Documented Change observed

Security signals

Public evidence provides enough material to document this angle

Angle 10

Security signals

Documented Change observed

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

30evidence
19changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
30
Signals
0
Changes
19
http_header headers 41df472d11481594ad9e0ce5b48c0b64bd09d97e75e86fc9346e6e951bf6160d 
[
    "strict-origin-when-cross-origin"
]
dns_address dns dbd91a8105c953331b6f955d8369efd160a59ce5ebace3569426dfb9e73f5cdb 
"2606:4700:3032::6815:6f0"
module_finding sovereignty 06d8ae5f0d6c408ef917cd319def558af5af875bf1b3392e436703bab99d2d4b 
{
    "evidence": [
        "Cloudflare",
        "LinkedIn"
    ],
    "severity": "high"
}
dns_address dns 4c79417eba9dcd122e62d9ca495bea7bcf308a6a39cc96fe9280b60d20c95c78 
"104.21.6.240"
http_header headers ee6b075b7b9506b65346d97e6d38bb0c8bfaeb7bc04ca703f53bed632d8475bc 
[
    "DENY"
]
tls_valid_to tls 8a5c37b8c15dfbd2d9a84ec20d4b888f4d978a06b020edcb535ed1e24a8a0a0f 
"2026-10-20T02:33:05+00:00"
http_header headers ba5b8b44d1563c24aa81a3a765996dc531e9ca5a426b99fb95e9abe58489af4e 
[
    "same-origin"
]
http_header headers fd38b3f7e94f49702bcf3bccc5b45060815a43fb225f6e58dca9c45e92f627f2 
[
    "nosniff"
]
mail_policy_flag mail_trust c7f111d6bd69101e6453b11ee2cfd29e9bd59b1f04ab1826bf1f74991dc973d8 
false
http_header headers f38fe8ca9b3483adeb8d311afdcb9bd4ee9d99318b80c56d35d9dcf4d1a31d1c 
[
    "cloudflare"
]
module_finding dns 03ad054b3bc28aa961513c15a3b0d622fb4009fe086bcbefea644c299f884e0a 
{
    "evidence": {
        "reason": "No external validating resolver is used; cryptographic validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
mail_policy_flag mail_trust e6867c3da35d8b75e33155fad24ad09e64afbb5834785db46b2ba33a79420232 
false
spf_policy mail_trust 6c72031acf458f10651e9e4d28f71272e6767958361b540e38ffc0f0a4f63133 
"missing"
mail_policy_flag mail_trust b0176d15b6bd220d68ec2aa1c7d047f1deddb7540fb6eedf44b5f612d5280f1c 
false
dns_address dns b1f81cbd624e70ab7a8e66a0081c325af801e44eacbff27be3a21ca2f9680157 
"2606:4700:3037::ac43:8779"
cookie privacy bbeaa411ea3bbb2992e06a5f54a19595857d9c00b72e24e3217ce7663acbb7ba 
{
    "http_only": true,
    "name": "quaric_lang",
    "same_site": "strict",
    "secure": true
}
module_finding dependencies 59da5cf60b4f12c5b1db37ae3a43ee4773e1e10c9602ee5b8264f7cc1af8fe55 
{
    "evidence": [
        "0bla.com",
        "static.cloudflareinsights.com"
    ],
    "severity": "medium"
}
dns_address dns ebde5d8b7b51e8bf529c2d8a2cdcb7aae935facd03ed466d88db7a0a12c205e6 
"172.67.135.121"
module_finding privacy 342568745889882df68150d30ed17b49d1f39bc3bf2c2b7fb1f5ccd60ec2979a 
{
    "evidence": [
        "LinkedIn"
    ],
    "severity": "medium"
}
http_header headers 2571f5b2f7b486e65cc54dd0a19746e41a6fc918c7f28cd2c90cbeef4ce08934 
[
    "default-src 'none'; script-src 'nonce-JOWl9XGV0kfGCP6iifM3aQ==' 'strict-dynamic'; style-src 'self' 'nonce-JOWl9XGV0kfGCP6iifM3aQ=='; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; manifest-src 'self'"
]
module_finding dns d9135142bbd2eaaa8148117103ff9ecab432666c3f35676f4e960aee4cf3de2a 
{
    "evidence": [],
    "severity": "high"
}
http_header headers 2936ff32eb12d742d7b3ba801e8cc1af09d7af6ad6d483a29506f491c84ca2fa 
[
    "max-age=63072000; includeSubDomains; preload"
]
http_header headers 8a8ed21b62e6cc88282b7ad8cd79e05026a9a37470c8a6fa171dfac90fd2d998 
[
    "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
]
module_finding dns b7d3abe751eef9e718ae61e88eb60d79d28a8fd7986f13dc41f61eb3c3970d84 
{
    "evidence": null,
    "severity": "low"
}
11
To determine First observation

Evolution over time

This angle still needs additional public evidence

Angle 11

Evolution over time

To determine First observation

This angle still needs additional public evidence

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

0evidence
43changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
0
Signals
0
Changes
43
12
Documented Stable

Evidence and traceability

Public evidence provides enough material to document this angle

Angle 12

Evidence and traceability

Documented Stable

Public evidence provides enough material to document this angle

01

Why it matters

This angle matters because it helps turn isolated public signals into information that can support a decision.

02

How to read it

Scanapse relates public observations, evidence and changes while keeping facts separate from interpretation.

03

What it is for

Provide a usable reading for technical teams, decision-makers and governance roles without exposing unnecessary internal mechanics.

04

What it does not prove

Public evidence is limited to the observed scope and does not prove internal, contractual or unobserved properties.

Material available for this angle

42evidence
0changes
0open questions
Show technical details for this angle

This level supports auditability and reproducibility. It is not required to understand the main reading.

Mapping version
2.3.1
Evidence
42
Signals
2
Changes
0
http_header headers 41df472d11481594ad9e0ce5b48c0b64bd09d97e75e86fc9346e6e951bf6160d 
[
    "strict-origin-when-cross-origin"
]
dns_address dns dbd91a8105c953331b6f955d8369efd160a59ce5ebace3569426dfb9e73f5cdb 
"2606:4700:3032::6815:6f0"
module_finding sovereignty 06d8ae5f0d6c408ef917cd319def558af5af875bf1b3392e436703bab99d2d4b 
{
    "evidence": [
        "Cloudflare",
        "LinkedIn"
    ],
    "severity": "high"
}
dependency_provider dependencies 20753772ee6b35ea28a48819fe1cd1484a81e25949d5f7fdf8bbec6693843231 
{
    "critical": true,
    "hosts": [
        "cloudflare.com"
    ],
    "id": "cloudflare",
    "known": true,
    "name": "Cloudflare",
    "observation_count": 1,
    "services": [
        "cdn",
        "security"
    ],
    "tracker": false
}
dns_address dns 4c79417eba9dcd122e62d9ca495bea7bcf308a6a39cc96fe9280b60d20c95c78 
"104.21.6.240"
dependency_provider dependencies 43943d20704294616895eb3216a93dc23a59b78d3772570dec7cba878c20e6ac 
{
    "critical": false,
    "hosts": [
        "0bla.com"
    ],
    "id": "host-d60d939674d6",
    "known": false,
    "name": "0bla.com",
    "observation_count": 1,
    "services": [
        "unknown"
    ],
    "tracker": false
}
http_header headers ee6b075b7b9506b65346d97e6d38bb0c8bfaeb7bc04ca703f53bed632d8475bc 
[
    "DENY"
]
tls_valid_to tls 8a5c37b8c15dfbd2d9a84ec20d4b888f4d978a06b020edcb535ed1e24a8a0a0f 
"2026-10-20T02:33:05+00:00"
mail_transport_evidence mail_transport 179ad4794b94b07023ae6501d9885a069dbf3d6a477e8faf081873ccb9477a8e 
{
    "bimi": {
        "records": [],
        "state": "not_observed"
    },
    "dane_tlsa": {
        "query_supported": false,
        "reason": "tlsa_query_not_available",
        "records": [],
        "state": "untested"
    },
    "dkim": {
        "reason": "no_selector_bruteforce",
        "state": "untested"
    },
    "mta_sts": {
        "policy": null,
        "policy_state": "untested",
        "records": [],
        "state": "not_observed"
    },
    "tls_rpt": {
        "records": [],
        "state": "not_observed"
    }
}
http_header headers ba5b8b44d1563c24aa81a3a765996dc531e9ca5a426b99fb95e9abe58489af4e 
[
    "same-origin"
]
openpgp_discovery openpgp_discovery c1fc8b74b38d3a97c25a594ce3e6500e455fa3d67736f0c24a73ab64390ddd1e 
{
    "dns_openpgpkey": {
        "reason": "recipient_identity_required",
        "state": "untested"
    },
    "fingerprint": null,
    "mechanisms": [
        "https://repo.quaric.org/assets/koperateur-pubkey.asc"
    ],
    "reason": "security_txt_encryption_observed",
    "state": "observed",
    "wkd": {
        "reason": "wkd_not_fetched_without_identity",
        "state": "untested"
    }
}
http_header headers fd38b3f7e94f49702bcf3bccc5b45060815a43fb225f6e58dca9c45e92f627f2 
[
    "nosniff"
]
mail_policy_flag mail_trust c7f111d6bd69101e6453b11ee2cfd29e9bd59b1f04ab1826bf1f74991dc973d8 
false
modern_transport_evidence modern_transport 484b411404c94c73ce3e1ecc329d414faefd8ab17a6acd5fdcfc0455ca5087d9 
{
    "alpn": {
        "state": "untested",
        "value": ""
    },
    "certificate": {
        "cipher": "",
        "issuer": "C = US, O = Let's Encrypt, CN = YE2",
        "protocol": "",
        "san_count": 0,
        "state": "observed",
        "valid_from": "2026-07-22T02:33:06+00:00",
        "valid_to": "2026-10-20T02:33:05+00:00"
    },
    "http2": {
        "negotiated": "3",
        "state": "untested"
    },
    "http3_advertised": {
        "alt_svc": "h3=\":443\"; ma=86400",
        "state": "observed"
    },
    "ipv4": {
        "addresses": [
            "104.21.6.240",
            "172.67.135.121"
        ],
        "state": "observed"
    },
    "ipv6": {
        "addresses": [
            "2606:4700:3032::6815:6f0",
            "2606:4700:3037::ac43:8779"
        ],
        "state": "observed"
    }
}
http_header headers f38fe8ca9b3483adeb8d311afdcb9bd4ee9d99318b80c56d35d9dcf4d1a31d1c 
[
    "cloudflare"
]
module_finding dns 03ad054b3bc28aa961513c15a3b0d622fb4009fe086bcbefea644c299f884e0a 
{
    "evidence": {
        "reason": "No external validating resolver is used; cryptographic validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}
mail_policy_flag mail_trust e6867c3da35d8b75e33155fad24ad09e64afbb5834785db46b2ba33a79420232 
false
csp_evidence csp_depth ada546f6b7f238f29a6999679287364ca277d44e2ef2e943165c2d73e51004e1 
{
    "enforced": true,
    "frame_ancestors": true,
    "hash_present": false,
    "nonce_present": true,
    "object_src": false,
    "report_only": false,
    "reporting_endpoint": false,
    "state": "observed",
    "strict_dynamic": true,
    "trusted_types": false
}
dependency_provider dependencies 9542f7cec5d1b7a7918d9861593b80617d79c1975f9cc0a3ba662c9ea849230f 
{
    "critical": false,
    "hosts": [
        "static.cloudflareinsights.com"
    ],
    "id": "host-d15afad5fd0c",
    "known": false,
    "name": "static.cloudflareinsights.com",
    "observation_count": 1,
    "services": [
        "unknown"
    ],
    "tracker": false
}
spf_policy mail_trust 6c72031acf458f10651e9e4d28f71272e6767958361b540e38ffc0f0a4f63133 
"missing"
mail_policy_flag mail_trust b0176d15b6bd220d68ec2aa1c7d047f1deddb7540fb6eedf44b5f612d5280f1c 
false
post_quantum_tls pq_tls_probe 4a02e403143a4654c42480544efa40884d2bd99678b4e6a8b6d5f5ba902c7aea 
{
    "capability": {
        "capable": false,
        "groups": [],
        "reason": "proc_open_unavailable"
    },
    "group": null,
    "reason": "client_capability_unavailable",
    "state": "untested"
}
dns_address dns b1f81cbd624e70ab7a8e66a0081c325af801e44eacbff27be3a21ca2f9680157 
"2606:4700:3037::ac43:8779"
cookie privacy bbeaa411ea3bbb2992e06a5f54a19595857d9c00b72e24e3217ce7663acbb7ba 
{
    "http_only": true,
    "name": "quaric_lang",
    "same_site": "strict",
    "secure": true
}

Overview

What the domain already shows, and what still needs clarification

An overview of visible relationships and uncertainty areas that still need verification.

Visible relations

Visible relations around the domain

Relations are grouped by function. They describe what is publicly visible, not contracts or the full internal architecture.

Observed domain repo.quaric.org

technology

1
Observed technology Observed

cloudflare

external resources

4
External provider or resource Observed

LinkedIn

External provider or resource Observed

Cloudflare

External provider or resource Observed

static.cloudflareinsights.com

External provider or resource Observed

0bla.com

Open questions

2 areas to confirm

An unknown becomes useful information when it precisely explains what is missing to reach a conclusion.

To confirm

Origin hosting

An edge service does not reveal the origin hosting provider.

To confirm

Effective data location

Public provider metadata does not prove where data is actually processed.

These items do not mean there is a problem. They simply show that useful information is still missing.

Sources and evidence

Evidence supporting this reading

42 evidence items are available. They remain collapsed to preserve a short reading and can be explored on demand.

42evidence items available

Each proof keeps its method, provenance, date, reliability and interpretation limits.

Download evidence JSON
Explore evidence
#01 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "strict-origin-when-cross-origin" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "strict-origin-when-cross-origin"
]

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#02 DNS public records

Evidence: dns_address

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
2606:4700:3032::6815:6f0
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig A repo.quaric.org && dig AAAA repo.quaric.org
View raw data 
2606:4700:3032::6815:6f0

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#03 module_finding

Evidence: module_finding

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "evidence": [ "Cloudflare", "LinkedIn" ], "severity": "high" }
Understand
Public observation
Source
module_finding
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": [
        "Cloudflare",
        "LinkedIn"
    ],
    "severity": "high"
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#04 Observed public resources

Evidence: dependency_provider

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "critical": true, "hosts": [ "cloudflare.com" ], "id": "cloudflare", "known": true, "name": "Cloudflare", "observation_count": 1, "services": [ "cdn", "security" ], "tracker": false }
Understand
Public HTML/resource dependency extraction and provider matching
Source
Observed public resources
Reliability
Medium
What this supports
Describe visible third-party dependencies
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "critical": true,
    "hosts": [
        "cloudflare.com"
    ],
    "id": "cloudflare",
    "known": true,
    "name": "Cloudflare",
    "observation_count": 1,
    "services": [
        "cdn",
        "security"
    ],
    "tracker": false
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#05 DNS public records

Evidence: dns_address

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
104.21.6.240
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig A repo.quaric.org && dig AAAA repo.quaric.org
View raw data 
104.21.6.240

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#06 Observed public resources

Evidence: dependency_provider

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "critical": false, "hosts": [ "0bla.com" ], "id": "host-d60d939674d6", "known": false, "name": "0bla.com", "observation_count": 1, "services": [ "unknown" ], "tracker": false }
Understand
Public HTML/resource dependency extraction and provider matching
Source
Observed public resources
Reliability
Medium
What this supports
Describe visible third-party dependencies
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "critical": false,
    "hosts": [
        "0bla.com"
    ],
    "id": "host-d60d939674d6",
    "known": false,
    "name": "0bla.com",
    "observation_count": 1,
    "services": [
        "unknown"
    ],
    "tracker": false
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#07 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "DENY" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "DENY"
]

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#08 Public TLS endpoint

Evidence: tls_valid_to

TLS protects the observed connection between the scanner and the public service.

Active non-intrusive High
Why it matters

These elements document public-channel protection and the cryptographic mechanisms actually negotiated.

What to check next

Compare negotiated protocol, issuer, expiry, chain and cryptographic parameters with history. Check other public entry points separately.

Possible action

Address only observed gaps such as an expiring certificate, invalid chain, or unwanted protocol. Test changes in a controlled environment before deployment.

Observation
2026-10-20T02:33:05+00:00
Understand
TLS handshake and public certificate inspection
Source
Public TLS endpoint
Reliability
High
What this supports
Describe the TLS session and certificate presented to Scanapse
What this does not prove
Strong TLS does not prove application security or origin-server security behind a CDN or reverse proxy.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
2026-10-20T02:33:05+00:00

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#09 mail_transport_evidence

Evidence: mail_transport_evidence

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "bimi": { "records": [], "state": "not_observed" }, "dane_tlsa": { "query_supported": false, "reason": "tlsa_query_not_available", "records": [], "state": "untested" }, "dkim": { "reason": "no_selector_bruteforce", "state": "untested" }, "mta_sts": { "policy": null, "policy_state": "untested", "records": [], "state": "not_observed" }, "tls_rpt": { "records": [], "state": "not_observed" } }
Understand
Public observation
Source
mail_transport_evidence
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "bimi": {
        "records": [],
        "state": "not_observed"
    },
    "dane_tlsa": {
        "query_supported": false,
        "reason": "tlsa_query_not_available",
        "records": [],
        "state": "untested"
    },
    "dkim": {
        "reason": "no_selector_bruteforce",
        "state": "untested"
    },
    "mta_sts": {
        "policy": null,
        "policy_state": "untested",
        "records": [],
        "state": "not_observed"
    },
    "tls_rpt": {
        "records": [],
        "state": "not_observed"
    }
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#10 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "same-origin" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "same-origin"
]

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#11 openpgp_discovery

Evidence: openpgp_discovery

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "dns_openpgpkey": { "reason": "recipient_identity_required", "state": "untested" }, "fingerprint": null, "mechanisms": [ "https://repo.quaric.org/assets/koperateur-pubkey.asc" ], "reason": "security_txt_encryption_observed", "state": "observed", "wkd": { "reason": "wkd_not_fetched_without_identity", "state": "untested" } }
Understand
Public observation
Source
openpgp_discovery
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "dns_openpgpkey": {
        "reason": "recipient_identity_required",
        "state": "untested"
    },
    "fingerprint": null,
    "mechanisms": [
        "https://repo.quaric.org/assets/koperateur-pubkey.asc"
    ],
    "reason": "security_txt_encryption_observed",
    "state": "observed",
    "wkd": {
        "reason": "wkd_not_fetched_without_identity",
        "state": "untested"
    }
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#12 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "nosniff" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "nosniff"
]

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#13 Mail-related public records

Evidence: mail_policy_flag

Public mail policies show how the domain frames sending, authentication and email transport.

Active non-intrusive High
Why it matters

These mechanisms can reduce domain spoofing and document mail-transport posture.

What to check next

Relate SPF, DKIM when a selector is known, DMARC, MX, MTA-STS and TLS-RPT. Compare policy changes over time.

Possible action

Before strengthening a policy, inventory legitimate mail flows and verify alignment. Roll out changes progressively to avoid blocking authorized senders.

Observation
Understand
Public DNS and policy endpoint inspection
Source
Mail-related public records
Reliability
High
What this supports
Describe published mail authentication and transport policies
What this does not prove
They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#14 modern_transport_evidence

Evidence: modern_transport_evidence

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "alpn": { "state": "untested", "value": "" }, "certificate": { "cipher": "", "issuer": "C = US, O = Let's Encrypt, CN = YE2", "protocol": "", "san_count": 0, "state": "observed", "valid_from": "2026-07-22T02:33:06+00:00", "valid_to": "2026-10-20T02:33:05+00:00" }, "http2": { "negotiated": "3", "state": "untested" }, "http3_advertised": { "alt_svc": "h3=\":443\"; ma=86400", "state": "observed" }, "ipv4": { "addresses": [ "104.21.6.240", "172.67.135.121" ], "state": "observed" }, "ipv6": { "addresses": [ "2606:4700:3032::6815:6f0", "2606:4700:3037::ac43:8779" ], "state": "observed" } }
Understand
Public observation
Source
modern_transport_evidence
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "alpn": {
        "state": "untested",
        "value": ""
    },
    "certificate": {
        "cipher": "",
        "issuer": "C = US, O = Let's Encrypt, CN = YE2",
        "protocol": "",
        "san_count": 0,
        "state": "observed",
        "valid_from": "2026-07-22T02:33:06+00:00",
        "valid_to": "2026-10-20T02:33:05+00:00"
    },
    "http2": {
        "negotiated": "3",
        "state": "untested"
    },
    "http3_advertised": {
        "alt_svc": "h3=\":443\"; ma=86400",
        "state": "observed"
    },
    "ipv4": {
        "addresses": [
            "104.21.6.240",
            "172.67.135.121"
        ],
        "state": "observed"
    },
    "ipv6": {
        "addresses": [
            "2606:4700:3032::6815:6f0",
            "2606:4700:3037::ac43:8779"
        ],
        "state": "observed"
    }
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#15 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "cloudflare" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "cloudflare"
]

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#16 DNS public records

Evidence: module_finding

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "evidence": { "reason": "No external validating resolver is used; cryptographic validation is intentionally not inferred.", "status": "not_tested" }, "severity": "info" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": {
        "reason": "No external validating resolver is used; cryptographic validation is intentionally not inferred.",
        "status": "not_tested"
    },
    "severity": "info"
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#17 Mail-related public records

Evidence: mail_policy_flag

Public mail policies show how the domain frames sending, authentication and email transport.

Active non-intrusive High
Why it matters

These mechanisms can reduce domain spoofing and document mail-transport posture.

What to check next

Relate SPF, DKIM when a selector is known, DMARC, MX, MTA-STS and TLS-RPT. Compare policy changes over time.

Possible action

Before strengthening a policy, inventory legitimate mail flows and verify alignment. Roll out changes progressively to avoid blocking authorized senders.

Observation
Understand
Public DNS and policy endpoint inspection
Source
Mail-related public records
Reliability
High
What this supports
Describe published mail authentication and transport policies
What this does not prove
They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#18 csp_evidence

Evidence: csp_evidence

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "enforced": true, "frame_ancestors": true, "hash_present": false, "nonce_present": true, "object_src": false, "report_only": false, "reporting_endpoint": false, "state": "observed", "strict_dynamic": true, "trusted_types": false }
Understand
Public observation
Source
csp_evidence
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "enforced": true,
    "frame_ancestors": true,
    "hash_present": false,
    "nonce_present": true,
    "object_src": false,
    "report_only": false,
    "reporting_endpoint": false,
    "state": "observed",
    "strict_dynamic": true,
    "trusted_types": false
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#19 Observed public resources

Evidence: dependency_provider

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "critical": false, "hosts": [ "static.cloudflareinsights.com" ], "id": "host-d15afad5fd0c", "known": false, "name": "static.cloudflareinsights.com", "observation_count": 1, "services": [ "unknown" ], "tracker": false }
Understand
Public HTML/resource dependency extraction and provider matching
Source
Observed public resources
Reliability
Medium
What this supports
Describe visible third-party dependencies
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "critical": false,
    "hosts": [
        "static.cloudflareinsights.com"
    ],
    "id": "host-d15afad5fd0c",
    "known": false,
    "name": "static.cloudflareinsights.com",
    "observation_count": 1,
    "services": [
        "unknown"
    ],
    "tracker": false
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#20 Mail-related public records

Evidence: spf_policy

Public mail policies show how the domain frames sending, authentication and email transport.

Active non-intrusive High
Why it matters

These mechanisms can reduce domain spoofing and document mail-transport posture.

What to check next

Relate SPF, DKIM when a selector is known, DMARC, MX, MTA-STS and TLS-RPT. Compare policy changes over time.

Possible action

Before strengthening a policy, inventory legitimate mail flows and verify alignment. Roll out changes progressively to avoid blocking authorized senders.

Observation
missing
Understand
Public DNS and policy endpoint inspection
Source
Mail-related public records
Reliability
High
What this supports
Describe published mail authentication and transport policies
What this does not prove
They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig TXT repo.quaric.org
View raw data 
missing

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#21 Mail-related public records

Evidence: mail_policy_flag

Public mail policies show how the domain frames sending, authentication and email transport.

Active non-intrusive High
Why it matters

These mechanisms can reduce domain spoofing and document mail-transport posture.

What to check next

Relate SPF, DKIM when a selector is known, DMARC, MX, MTA-STS and TLS-RPT. Compare policy changes over time.

Possible action

Before strengthening a policy, inventory legitimate mail flows and verify alignment. Roll out changes progressively to avoid blocking authorized senders.

Observation
Understand
Public DNS and policy endpoint inspection
Source
Mail-related public records
Reliability
High
What this supports
Describe published mail authentication and transport policies
What this does not prove
They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#22 post_quantum_tls

Evidence: post_quantum_tls

This check only looks for a public TLS termination negotiating a hybrid key exchange supported by Scanapse.

Passive Medium
Why it matters

It documents cryptographic readiness without confusing it with overall system security.

What to check next

Record the actually negotiated group, tested endpoint, and measurement-client version. Compare results over time and across other public frontends.

Possible action

Do not enable or disable a mechanism merely to obtain a badge. Assess compatibility, TLS termination, clients and cryptographic strategy before changing it.

Observation
{ "capability": { "capable": false, "groups": [], "reason": "proc_open_unavailable" }, "group": null, "reason": "client_capability_unavailable", "state": "untested" }
Understand
Public observation
Source
post_quantum_tls
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A positive result does not make a site “post-quantum”, and a negative result does not prove no other client could negotiate it.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "capability": {
        "capable": false,
        "groups": [],
        "reason": "proc_open_unavailable"
    },
    "group": null,
    "reason": "client_capability_unavailable",
    "state": "untested"
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#23 DNS public records

Evidence: dns_address

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
2606:4700:3037::ac43:8779
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig A repo.quaric.org && dig AAAA repo.quaric.org
View raw data 
2606:4700:3037::ac43:8779

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#24 Observed public page

Evidence: cookie

Scanapse describes only privacy signals visible on the observed public journey.

Passive Medium
Why it matters

This separates what the browser actually encounters from what cannot be measured externally.

What to check next

Relate visible cookies and third parties to actual features, then compare those observations with internal documentation when the organisation has it.

Possible action

Remove unnecessary trackers or cookies and document the purposes of required elements. Any legal assessment must remain separate from the external scan.

Observation
{ "http_only": true, "name": "quaric_lang", "same_site": "strict", "secure": true }
Understand
Visible cookies and tracker signatures on the public response
Source
Observed public page
Reliability
Medium
What this supports
Describe visible privacy-related signals
What this does not prove
This observation is never a GDPR audit and does not reveal every purpose or internal processing activity.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "http_only": true,
    "name": "quaric_lang",
    "same_site": "strict",
    "secure": true
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#25 Observed public resources

Evidence: module_finding

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "evidence": [ "0bla.com", "static.cloudflareinsights.com" ], "severity": "medium" }
Understand
Public HTML/resource dependency extraction and provider matching
Source
Observed public resources
Reliability
Medium
What this supports
Describe visible third-party dependencies
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": [
        "0bla.com",
        "static.cloudflareinsights.com"
    ],
    "severity": "medium"
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#26 DNS public records

Evidence: dns_address

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
172.67.135.121
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

dig A repo.quaric.org && dig AAAA repo.quaric.org
View raw data 
172.67.135.121

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#27 Observed public page

Evidence: module_finding

Scanapse describes only privacy signals visible on the observed public journey.

Passive Medium
Why it matters

This separates what the browser actually encounters from what cannot be measured externally.

What to check next

Relate visible cookies and third parties to actual features, then compare those observations with internal documentation when the organisation has it.

Possible action

Remove unnecessary trackers or cookies and document the purposes of required elements. Any legal assessment must remain separate from the external scan.

Observation
{ "evidence": [ "LinkedIn" ], "severity": "medium" }
Understand
Visible cookies and tracker signatures on the public response
Source
Observed public page
Reliability
Medium
What this supports
Describe visible privacy-related signals
What this does not prove
This observation is never a GDPR audit and does not reveal every purpose or internal processing activity.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": [
        "LinkedIn"
    ],
    "severity": "medium"
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#28 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "default-src 'none'; script-src 'nonce-JOWl9XGV0kfGCP6iifM3aQ==' 'strict-dynamic'; style-src 'self' 'nonce-JOWl9XGV0kfGCP6iifM3aQ=='; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; manifest-src 'self'" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "default-src 'none'; script-src 'nonce-JOWl9XGV0kfGCP6iifM3aQ==' 'strict-dynamic'; style-src 'self' 'nonce-JOWl9XGV0kfGCP6iifM3aQ=='; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'; manifest-src 'self'"
]

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#29 DNS public records

Evidence: module_finding

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "evidence": [], "severity": "high" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": [],
    "severity": "high"
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#30 Observed public resources

Evidence: dependency_provider

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "critical": false, "hosts": [ "www.linkedin.com" ], "id": "linkedin", "known": true, "name": "LinkedIn", "observation_count": 1, "services": [ "advertising", "social" ], "tracker": true }
Understand
Public HTML/resource dependency extraction and provider matching
Source
Observed public resources
Reliability
Medium
What this supports
Describe visible third-party dependencies
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "critical": false,
    "hosts": [
        "www.linkedin.com"
    ],
    "id": "linkedin",
    "known": true,
    "name": "LinkedIn",
    "observation_count": 1,
    "services": [
        "advertising",
        "social"
    ],
    "tracker": true
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#31 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "max-age=63072000; includeSubDomains; preload" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "max-age=63072000; includeSubDomains; preload"
]

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#32 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), serial=(), unload=()"
]

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#33 DNS public records

Evidence: module_finding

DNS shows how a domain resolves and which public services are associated with it.

Passive High
Why it matters

Consistent, verifiable resolution reduces some spoofing risks and helps explain entity dependencies.

What to check next

Compare NS, A/AAAA, MX, CAA and the DNSSEC chain with previous measurements to identify delegation or operator changes.

Possible action

If a change is unexpected, verify registrar and DNS-provider configuration before modifying anything. Document the failover mechanisms that actually exist.

Observation
{ "evidence": null, "severity": "low" }
Understand
Standard DNS resolution and record parsing
Source
DNS public records
Reliability
High
What this supports
Describe public DNS data observed at scan time
What this does not prove
Public DNS does not prove physical server location, contracts, or global availability.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": null,
    "severity": "low"
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#34 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "require-corp" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "require-corp"
]

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#35 technology

Evidence: technology

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "name": "cloudflare", "version": "", "version_exposed": false }
Understand
Public observation
Source
technology
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "name": "cloudflare",
    "version": "",
    "version_exposed": false
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#36 module_finding

Evidence: module_finding

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "evidence": [ "0bla.com", "static.cloudflareinsights.com" ], "severity": "medium" }
Understand
Public observation
Source
module_finding
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": [
        "0bla.com",
        "static.cloudflareinsights.com"
    ],
    "severity": "medium"
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#37 dnssec_evidence

Evidence: dnssec_evidence

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "chain_consistency": { "reason": "insufficient_record_evidence", "state": "untested" }, "dnskey": { "query_supported": false, "records": [], "state": "untested" }, "ds": { "query_supported": false, "records": [], "state": "untested" }, "validation": { "reason": "no_validating_resolver", "state": "untested" } }
Understand
Public observation
Source
dnssec_evidence
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "chain_consistency": {
        "reason": "insufficient_record_evidence",
        "state": "untested"
    },
    "dnskey": {
        "query_supported": false,
        "records": [],
        "state": "untested"
    },
    "ds": {
        "query_supported": false,
        "records": [],
        "state": "untested"
    },
    "validation": {
        "reason": "no_validating_resolver",
        "state": "untested"
    }
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#38 canary_signal

Evidence: canary_signal

Scanapse shows visible providers and third-party services on which the public service depends.

Passive Medium
Why it matters

Concentration on one actor or many third parties can affect continuity and governance.

What to check next

Identify each provider role, functions concentrated on the same actor, and dependencies that appeared or disappeared since the previous scan.

Possible action

For a critical dependency, document owner, contract, reversibility, failover and rationale. Diversify only after analysing the actual need.

Observation
{ "matches": [ { "name": "canary_field", "source": "security_txt" } ], "reason": "known_passive_signature_observed", "signature_version": "2026.09.1", "state": "observed" }
Understand
Public observation
Source
canary_signal
Reliability
Medium
What this supports
Describe the observed public artefact
What this does not prove
A visible dependency does not prove data location, actual contractual jurisdiction, or hidden subcontractors.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "matches": [
        {
            "name": "canary_field",
            "source": "security_txt"
        }
    ],
    "reason": "known_passive_signature_observed",
    "signature_version": "2026.09.1",
    "state": "observed"
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#39 Observed public page

Evidence: tracker_provider

Scanapse describes only privacy signals visible on the observed public journey.

Passive Medium
Why it matters

This separates what the browser actually encounters from what cannot be measured externally.

What to check next

Relate visible cookies and third parties to actual features, then compare those observations with internal documentation when the organisation has it.

Possible action

Remove unnecessary trackers or cookies and document the purposes of required elements. Any legal assessment must remain separate from the external scan.

Observation
LinkedIn
Understand
Visible cookies and tracker signatures on the public response
Source
Observed public page
Reliability
Medium
What this supports
Describe visible privacy-related signals
What this does not prove
This observation is never a GDPR audit and does not reveal every purpose or internal processing activity.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
LinkedIn

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#40 Public TLS endpoint

Evidence: tls_issuer

TLS protects the observed connection between the scanner and the public service.

Active non-intrusive High
Why it matters

These elements document public-channel protection and the cryptographic mechanisms actually negotiated.

What to check next

Compare negotiated protocol, issuer, expiry, chain and cryptographic parameters with history. Check other public entry points separately.

Possible action

Address only observed gaps such as an expiring certificate, invalid chain, or unwanted protocol. Test changes in a controlled environment before deployment.

Observation
C = US, O = Let's Encrypt, CN = YE2
Understand
TLS handshake and public certificate inspection
Source
Public TLS endpoint
Reliability
High
What this supports
Describe the TLS session and certificate presented to Scanapse
What this does not prove
Strong TLS does not prove application security or origin-server security behind a CDN or reverse proxy.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

Verify it yourself

This command reproduces the public observation without changing the target.

openssl s_client -connect repo.quaric.org:443 -servername repo.quaric.org </dev/null
View raw data 
C = US, O = Let's Encrypt, CN = YE2

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#41 Mail-related public records

Evidence: module_finding

Public mail policies show how the domain frames sending, authentication and email transport.

Active non-intrusive High
Why it matters

These mechanisms can reduce domain spoofing and document mail-transport posture.

What to check next

Relate SPF, DKIM when a selector is known, DMARC, MX, MTA-STS and TLS-RPT. Compare policy changes over time.

Possible action

Before strengthening a policy, inventory legitimate mail flows and verify alignment. Roll out changes progressively to avoid blocking authorized senders.

Observation
{ "evidence": null, "severity": "info" }
Understand
Public DNS and policy endpoint inspection
Source
Mail-related public records
Reliability
High
What this supports
Describe published mail authentication and transport policies
What this does not prove
They do not prove actual deliverability, every recipient’s behavior, or the absence of phishing.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
{
    "evidence": null,
    "severity": "info"
}

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

#42 Public HTTP response

Evidence: http_header

HTTP headers can ask the browser to enforce specific protections.

Active non-intrusive High
Why it matters

They are visible, verifiable browser-side defensive layers.

What to check next

Read each full policy, identify permissive or contradictory directives, and compare responses across the main public routes.

Possible action

Harden policies progressively from actual application needs. Avoid copying generic templates without functional testing.

Observation
[ "same-origin" ]
Understand
HTTP response-header inspection
Source
Public HTTP response
Reliability
High
What this supports
Describe defensive policies declared on the observed response
What this does not prove
A header being present does not prove it is optimal or that the application has no vulnerabilities.

Standards and reference context

Regulatory references are contextual only. Scanapse does not determine whether a framework applies to the organization and does not issue an automatic compliance verdict.

View raw data 
[
    "same-origin"
]

Rule 2026.09.4 · 2026-09-06T01:58:48+00:00

Show technical details 
{
    "schema_version": "2.0",
    "engine_version": "2.9.2.1",
    "pattern_version": "2026.09.4",
    "scope": {
        "mode": "passive",
        "coverage": "full",
        "access_level": "full",
        "access_reason": "public_document_available",
        "requests": 2,
        "homepage_only": true,
        "javascript_executed": false,
        "ports_scanned": false,
        "private_networks_blocked": true,
        "protection_bypassed": false,
        "max_body_bytes": 1572864,
        "scan_budget_seconds": 24,
        "budget_exhausted": false,
        "transport": "curl_with_socket_fallback"
    },
    "entity": {
        "id": "3ae1fc11dce3af9ce1471b78454ab1ef21fb47363ae986f703cd8fa13c377d13",
        "display_name": "repo.quaric.org",
        "slug": "repo-quaric-org",
        "entity_type": "domain_subject",
        "auto_created": true,
        "primary_asset": "repo.quaric.org"
    },
    "methodology": {
        "version": "2.3.1",
        "model": "evidence_first",
        "principles": [
            "absence_of_evidence_is_not_evidence_of_absence",
            "unknown_remains_unknown",
            "provider_metadata_is_not_data_location",
            "edge_provider_is_not_origin_host",
            "single_snapshot_does_not_prove_resilience"
        ]
    },
    "trajectory_summary": {
        "has_previous_scan": true,
        "change_counts": {
            "appeared": 7,
            "modified": 1,
            "stable": 35
        },
        "observation_count": 42,
        "evidence_count": 42,
        "provider_count": 4,
        "strategic_signal_count": 1,
        "top_signal_count": 1
    }
}