Space message routing variants

Bounded bug-bounty probe for Hugging Face Space parent-message routing. It does

Description excerpted from the original listing, which is linked below.

Open it Listing

Facts

Published: 15 Sep 2026 (50m ago)
Medium: web
Creator: 0xmoose0xmoose0xmoose
First seen: 15 Sep 2026, 01:22 UTC

Built with

Not known. Nothing about this item shows which tool wrote it, and we would rather say so than guess.

Runs on

Static site: declared by the platform of origin

What we can see

77 hygiene score

Certificate issued by Amazon RSA 2048 M01, 120 days remaining
Cookie attributes no cookies set
Credentials and payment does not ask for either
Strict transport security set
Served over HTTPS
Mail authentication neither published
No insecure resources
Redirects 1
Security headers 1 of 5 set
Third-party origins none
Transport security TLS 1.3

Observed 15 Sep 2026 by fetching the page as a browser would. This describes hygiene and transparency, not safety: a missing header does not make a site dangerous, and a complete set does not make it trustworthy.

Changes we have seen

15 Sep 2026 first indexed