dead-drop vs Mozilla http scanner

dead-drop is a minimal, self-hostable API for sharing ephemeral secrets: the client encrypts the payload before it ever reaches the server, so the backend only ever stores ciphertext it cannot read, and each secret can be set to self-destruct after a single view or a time limit. It needs no account or API key — requests are simply rate-limited per IP — and returns plain JSON over a small REST surface. The design mirrors the classic one-time-secret pattern used for sharing passwords or tokens without leaving a permanent copy anywhere.

The HTTP Observatory grades a website's security headers -- CSP, HSTS, cookie flags, and more -- against Mozilla's recommended baseline, the same engine behind the long-running Mozilla Observatory scanner. The original mozilla/http-observatory Python API was shut down on 2024-10-31 when the tool moved to MDN; automated callers now POST to a v2 scan endpoint that returns a grade, score, and pass/fail counts, with a details link back to the full MDN report. It's fully public and keyless, rate-limited to one fresh scan per host per minute (cached results are returned for repeat calls within that window), and built for CI-pipeline use.