U Referrer Header Disclosure Matrix

{
  "billable": true,
  "findings": [
    {
      "confidence": 85,
      "evidence": [
        {
          "page_indices": [],
          "page_url": null,
          "pattern": "referrer-header-disclosure-matrix_scoped_evidence",
          "type": "raw_html"
        }
      ],
      "id": "referrer-header-disclosure-matrix",
      "limits": [
        "Only complete original RAM documents are examined. No additional fetch, execution, interaction, computed style, rendering or external state is asserted.",
        "Only numeric and boolean aggregates are returned. All source text, identifiers, names, addresses, contact data, URLs, headers and digest values remain private.",
        "Pure header-policy simulation using a fixed synthetic HTTPS source with a path and query. Matrix target rows are same-origin HTTPS, cross-origin HTTPS and HTTPS-to-HTTP downgrade. Columns are no referrer, origin-only and URL path/query eligible. These are eligibility classes, not transmitted bytes. No document URL is substituted into this simulation; all source and target URLs are synthetic. Policies follow the eight-token order documented in the output schema. Last recognized case-sensitive comma token wins; absent/unknown values select strict-origin-when-cross-origin. HTML meta, per-element overrides, redirects, origin trust exceptions, user preferences and actual browser requests are not asserted."
      ],
      "module": "referrer-header-disclosure-matrix",
      "module_cpu_ms": 1,
      "state": "observed",
      "value": {
        "default_policy_documents": 0,
        "documents": 1,
        "ignored_header_tokens": 0,
        "recognized_header_tokens": 1,
        "recognized_token_policy_changes": 0,
        "selected_policy_counts": [
          0,
          0,
          1,
          0,
          0,
          0,
          0,
          0
        ],
        "synthetic_target_disclosure_counts": [
          [
            0,
            0,
            1
          ],
          [
            1,
            0,
            0
          ],
          [
            1,
            0,
            0
          ]
        ]
      },
      "warnings": []
    }
  ],
  "known_count": 1,
  "scope": {
    "at": "2026-10-16T00:00:00.000Z",
    "contact_values_returned": false,
    "pages": 1,
    "rendered": false,
    "requests": 0
  },
  "warnings": [
    "Illustrative synthetic fixture only; not a customer or live-site assertion."
  ]
}

# bash or zsh: see the payment challenge. Nothing is charged.
curl -sS -g -i -X POST 'https://detect.halowerk.com/u/referrer-header-disclosure-matrix' \
  -H 'content-type: application/json' \
  --data-raw '{"url":"https://example.org/"}'

# x402 v2 sends the challenge base64-encoded in the PAYMENT-REQUIRED header (v1 sends it in the body).
# To read the header:
curl -sS -g -o /dev/null -D - -X POST 'https://detect.halowerk.com/u/referrer-header-disclosure-matrix' \
  -H 'content-type: application/json' \
  --data-raw '{"url":"https://example.org/"}' \
  | grep -i '^payment-required:' | cut -d' ' -f2 | tr -d '\r' | base64 --decode

// npm i @x402/fetch @x402/evm viem
import { wrapFetchWithPayment, x402Client } from "@x402/fetch";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

// Pays at most $0.003 per call.
const client = new x402Client().setSpendControls({ maxAmountPerPayment: "$0.003" });
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.EVM_PRIVATE_KEY) });
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? ToolVet checks it first for $0.005. Pay for that from a separate
// client: this one is capped at $0.003 per payment. GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Fdetect.halowerk.com%2Fu%2Freferrer-header-disclosure-matrix&method=POST
const res = await pay("https://detect.halowerk.com/u/referrer-header-disclosure-matrix", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({
    "url": "https://example.org/"
  }),
});
console.log(res.status, await res.text());

# pip install "x402[requests,evm]"
import os
from eth_account import Account
from x402 import x402ClientSync
from x402.http.clients import x402_requests
from x402.mechanisms.evm import EthAccountSigner
from x402.mechanisms.evm.exact.register import register_exact_evm_client

# Pays at most $0.003 per call.
client = x402ClientSync().set_spend_controls({"max_amount_per_payment": "$0.003"})
register_exact_evm_client(client, EthAccountSigner(Account.from_key(os.environ["EVM_PRIVATE_KEY"])))

with x402_requests(client) as session:
    res = session.post(
        "https://detect.halowerk.com/u/referrer-header-disclosure-matrix",
        json={
            "url": "https://example.org/",
        },
    )
    print(res.status_code, res.text)