HackproofHacks Developer Portal.
Everything a developer or an agent needs to call the HackproofHacks API: the full machine-readable spec, how authentication actually works here, rate limits, and a five-minute quickstart.
API specification.
The full OpenAPI 3.1 document — every endpoint, request schema, response schema, and error code — is published at:
https://hackproofhacks.com/openapi.json
Load it into any OpenAPI-aware client, or hand the URL to an LLM agent that supports
function calling / tool use — every operation has a unique operationId,
a description, and typed request/response schemas.
Endpoints at a glance.
/api/cve-stats Rolling 7-day CVE counts by severity, plus average CVSS. No auth, no rate limit.
/api/tools/header-check Grade the HTTP security headers a URL serves, with fix snippets.
/api/tools/ssl-check Read the TLS certificate a host is actually serving.
/api/tools/subdomain-finder Passive subdomain discovery from Certificate Transparency and passive DNS.
/api/tools/subdomain-check Opt-in active liveness probe for a single, explicitly authorised host.
/api/contact Contact, assessment, training, and workshop form intake.
/api/newsletter Subscribe an email address to the weekly newsletter.
Authentication model.
There is no API key today — every endpoint above is either fully public
(/api/cve-stats,
no auth at all) or gated to same-origin browser requests: the site's own frontend
sends an X-Requested-With header
and, on the higher-risk tools and forms, a Cloudflare Turnstile response token from a
real browser challenge. There is no server-side or headless path to a valid Turnstile
token, so those endpoints are not currently callable by an unattended script or agent
— that's a deliberate anti-abuse measure, not an oversight. Every response, success or
error, is JSON; see the ApiError schema
in the spec for the error shape.
Want programmatic access to the tools or a sandboxed key for automated testing? Get in touch — API keys for automation are on the roadmap and we prioritise based on real demand.
Rate limits.
Rate-limited endpoints return standard RateLimit-Limit,
RateLimit-Remaining, and
RateLimit-Reset headers
on every response (not just when you're over the limit), plus
Retry-After on a 429.
Limits are per client IP per rolling hour: 10/hr for contact, 3/hr for newsletter,
30/hr for the header and SSL checkers, 15/hr for subdomain discovery, 120/hr for the
liveness probe.
Quickstart: read live CVE data.
The one endpoint on this list you can call from anywhere, right now, with no headers and no token:
curl https://hackproofhacks.com/api/cve-statsMore for agents.
- • /llms.txt — what this site is, and when an agent should reach for it
- • Homepage supports
Accept: text/markdowncontent negotiation - • /sitemap-index.xml — every indexable URL on the site