Mozilla http scanner vs National Vulnerability Database

The HTTP Observatory grades a website's security headers -- CSP, HSTS, cookie flags, and more -- against Mozilla's recommended baseline, the same engine behind the long-running Mozilla Observatory scanner. The original mozilla/http-observatory Python API was shut down on 2024-10-31 when the tool moved to MDN; automated callers now POST to a v2 scan endpoint that returns a grade, score, and pass/fail counts, with a details link back to the full MDN report. It's fully public and keyless, rate-limited to one fresh scan per host per minute (cached results are returned for repeat calls within that window), and built for CI-pipeline use.

NIST's NVD API 2.0 is the government's canonical feed of CVE records, each enriched with CVSS scores, CPE product matches, CWE weakness types, and (where applicable) CISA Known Exploited Vulnerabilities flags. It's fully public and keyless, though a free API key lifts the rolling rate limit from 5 to 50 requests per 30 seconds, and NIST recommends polling by lastModStartDate/lastModEndDate rather than re-pulling the whole dataset. The stored URL pointed at a legacy JSON-feed changelog page; corrected to the current "Start Here" developer docs for the 2.0 REST API.