HackproofHacks
Developers

HackproofHacks Developer Portal.

Everything a developer or an agent needs to call the HackproofHacks API: the full machine-readable spec, how authentication actually works here, rate limits, and a five-minute quickstart.

API specification.

The full OpenAPI 3.1 document, every endpoint, request schema, response schema, and error code, is published at:

https://hackproofhacks.com/openapi.json

Load it into any OpenAPI-aware client, or hand the URL to an LLM agent that supports function calling / tool use, every operation has a unique operationId, a description, and typed request/response schemas.

Endpoints at a glance.

GET
/api/cve-stats

Rolling 7-day CVE counts by severity, plus average CVSS. No auth, no rate limit.

POST
/api/tools/header-check

Grade the HTTP security headers a URL serves, with fix snippets.

POST
/api/tools/ssl-check

Read the TLS certificate a host is actually serving.

POST
/api/tools/subdomain-finder

Passive subdomain discovery from Certificate Transparency and passive DNS.

POST
/api/tools/subdomain-check

Opt-in active liveness probe for a single, explicitly authorised host.

POST
/api/contact

Contact, assessment, training, and workshop form intake.

POST
/api/newsletter

Subscribe an email address to the weekly newsletter.

Authentication model.

There is no API key today, every endpoint above is either fully public (/api/cve-stats, no auth at all) or gated to same-origin browser requests: the site's own frontend sends an X-Requested-With header and, on the higher-risk tools and forms, a Cloudflare Turnstile response token from a real browser challenge. There is no server-side or headless path to a valid Turnstile token, so those endpoints are not currently callable by an unattended script or agent , that's a deliberate anti-abuse measure, not an oversight. Every response, success or error, is JSON; see the ApiError schema in the spec for the error shape.

Want programmatic access to the tools or a sandboxed key for automated testing?Get in touch, API keys for automation are on the roadmap and we prioritise based on real demand.

Rate limits.

Rate-limited endpoints return standard RateLimit-Limit,RateLimit-Remaining, andRateLimit-Reset headers on every response (not just when you're over the limit), plusRetry-After on a 429. Limits are per client IP per rolling hour: 10/hr for contact, 3/hr for newsletter, 30/hr for the header and SSL checkers, 15/hr for subdomain discovery, 120/hr for the liveness probe.

Quickstart: read live CVE data.

The one endpoint on this list you can call from anywhere, right now, with no headers and no token:

curl https://hackproofhacks.com/api/cve-stats
View the full OpenAPI spec

More for agents.

  • • /llms.txt, what this site is, and when an agent should reach for it
  • • Homepage supports Accept: text/markdown content negotiation
  • • /sitemap-index.xml, every indexable URL on the site