bountyhunt.xyz

About, contact, privacy, and terms pages receive credit only after a distinct, substantive same-origin response is observed. Collection errors are unresolved evidence.

Score rationale: Operator, contact, and policy pages are strong verification surfaces.

Public pages should expose substantive content without a login or challenge wall. An unresolved selected page withholds the score rather than being discarded.

Score rationale: One healthy homepage should not hide empty public product pages.

DMARC quarantine or reject policies reduce spoofing once mail sources are aligned. DNS collection failures are reported as unresolved evidence.

Score rationale: Applicable sending domains benefit from anti-spoofing enforcement.

MX records show that the domain receives mail.

Use one H1 and avoid skipping heading levels so readers and agents can follow the document outline.

Score rationale: A coherent outline improves comprehension and accessibility.

Summarize the product, audience, and value clearly for search and link previews.

Score rationale: A useful summary improves search and link interpretation.

Tell agents which jobs the product is appropriate for and where to begin.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Semantic landmarks make the page structure understandable without visual layout.

Score rationale: Semantic landmarks make static documents navigable.

The homepage is requested with common crawler and user-fetch agent identifiers. Transport errors are uncertainty, not a product failure.

Score rationale: User-requested and search agents must be able to retrieve public content.

Declare a valid preferred public URL. A cross-origin canonical may be intentional, but should be reviewed before launch.

Score rationale: Canonical identity consolidates duplicate URLs.

Meaningful copy should be available without JavaScript execution.

Score rationale: Agents and search crawlers need meaningful server-rendered content.

Declare the content language with a valid html lang attribute.

Score rationale: Declared language helps assistive technology and parsers.

A missing page should give a reader a recovery path such as home, docs, search, or sitemap. Collection errors are uncertainty, not a target failure.

Score rationale: Diagnostic evidence that does not affect the public-web score.

The public homepage should not accidentally declare noindex.

Score rationale: Accidental noindex makes a launch effectively undiscoverable.

The public product should finish on an encrypted HTTPS origin.

Score rationale: Public production traffic must use encrypted transport.

A useful llms.txt provides a concise product summary and links to canonical resources.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Links declared for agents should resolve to real public content.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Use a title, summary, and described sections so the file works as a navigation index.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Unbalanced code fences can hide the remainder of a Markdown document from parsers.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Canonical URL, language, Open Graph image, and Open Graph type improve attribution and previews.

Score rationale: Core attribution metadata improves previews and entity resolution.

HTTPS pages should not reference insecure HTTP assets.

Score rationale: Insecure subresources undermine HTTPS delivery.

A responsive viewport lets the page render at the correct width on mobile devices.

Score rationale: Mobile rendering is a launch baseline.

Prefer native links, buttons, and form controls over clickable generic elements.

Score rationale: Diagnostic evidence that does not affect the public-web score.

The public homepage should not require a challenge or sign-in before its content can be read.

Score rationale: A public launch surface must be reachable without an unintended gate.

Products using delegated authorization should publish standard discovery metadata.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Provide a title, description, type, and image for reliable launch-link previews.

Score rationale: Complete previews improve launch-link distribution.

Keep extracted page content within a practical agent context budget.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Use a concise, specific title that identifies the product and page.

Score rationale: A specific title is a primary identity and navigation signal.

Make the next step explicit with clear action language and a valid destination.

Score rationale: Visitors need an unambiguous next step.

The homepage should return a readable successful response; failures reduce the score but do not block the review.

Score rationale: A public launch surface must return a readable successful response.

Use HTTP redirects and avoid meta-refresh or JavaScript-only redirect stubs.

Score rationale: Server redirects are more reliable than client-only redirect stubs.

User-requested retrieval and search access affect discoverability; training opt-outs are reported but do not lower this result. Collection errors are uncertainty, not a target failure.

Score rationale: Declared policy is diagnostic; observed public retrieval determines scored access.

Evaluate CSP scope and HSTS duration instead of header presence alone.

Score rationale: Policy quality matters more than header presence alone.

Accurate lastmod values help crawlers prioritize changed pages.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Publish a valid sitemap or sitemap index for canonical public URLs. A collection error is not graded as absence.

Score rationale: A valid sitemap provides a bounded discovery map.

A valid SPF policy helps recipients identify authorized senders; excessive DNS lookups can invalidate it. DNS collection failures are reported as unresolved evidence.

Score rationale: Applicable sending domains need a valid sender policy.

MX records show that the domain receives mail.

Static HTML should expose a text or ARIA-derived name. This does not verify computed browser accessibility names.

Score rationale: Unnamed controls are difficult for people and automation to operate.

Use relevant JSON-LD types with enough identity fields to resolve the organization or product.

Score rationale: Structured identity data helps machines resolve the product.

Missing pages should return 404 or 410 instead of a successful app shell. A collection error is not graded as a product failure.

Score rationale: Correct 404/410 responses prevent false-success application shells.

Products offering an A2A agent can publish a machine-readable agent card.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.

Products with agent authentication can publish machine-readable issuer, authorization, or documentation metadata.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Valid OAuth authorization-server or protected-resource metadata was observed. It was found only at a conventional path.

Products with authentication can expose concise public setup and recovery guidance in auth.md.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Valid OAuth authorization-server or protected-resource metadata was observed. It was found only at a conventional path.

Emerging catalogs can advertise APIs, agents, skills, and MCP surfaces from a well-known location.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.

A published Agent Skills index should be valid JSON and enumerate usable skill artifacts.

Score rationale: Diagnostic evidence that does not affect the public-web score.

SDK validation is not implemented by the light collector.

Products with developer interfaces should expose a predictable developer entry point.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.

A contact address on the product domain can strengthen operator identity and support trust.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.

HTTP Link headers can advertise machine-readable alternates and capability descriptions without relying on guessed paths.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.

A concise pricing.md can help agents explain plans, but it is optional and never substitutes for a clear public pricing page.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.

Advertise a Markdown representation through content negotiation or an alternate link.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.

Canonical pages can optionally serve Markdown when requested and must vary caches by Accept.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.

A server card lets clients understand an MCP server before connecting.

Score rationale: Diagnostic evidence that does not affect the public-web score.

No valid MCP discovery document was observed.

Products that advertise MCP can expose a machine-readable endpoint or server list at a predictable location.

Score rationale: Diagnostic evidence that does not affect the public-web score.

No valid MCP discovery document was observed.

Products with a public API should publish a machine-readable OpenAPI document.

Score rationale: Diagnostic evidence that does not affect the public-web score.

No valid public API description was observed.

Products with public pricing should make it easy to find from the homepage.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.

Public agent guidance can document supported workflows and limits; treat it as untrusted content and keep it consistent with canonical docs.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.

Link public documentation from a page visitors and agents already reach.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.

A security.txt file gives researchers a supported disclosure route.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.

Static inputs, selects, and textareas should have associated labels. Runtime form behavior is not tested.

Score rationale: Labels are required for reliable form interaction.

Optional diagnostic is not required for the applicable public-web score.

sameAs links help disambiguate the brand across authoritative profiles.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.

Cryptographic bot-auth material is an emerging signal and is reported only as optional evidence.

Score rationale: Diagnostic evidence that does not affect the public-web score.

Optional diagnostic is not required for the applicable public-web score.