Security headers on Cloudflare Workers (Observatory vs a USDC audit)
If you ship on Cloudflare Workers, browsers still judge you by HTTP response headers: CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and friends.
Free checks first
- MDN HTTP Observatory — free scan/API, great for CI smoke checks.
- securityheaders.com — quick human-readable grade for a URL.
Use those while you iterate. They tell you what is missing; they do not always explain which Worker middleware or origin quirk caused a weak grade when you sit behind *.workers.dev, a custom domain, and a CDN.
When you want a pay-per-call audit
Our header-audit tool (2 USDC on Base, guest checkout) is built for agents and scripts that need a structured result without a human form. Pair it with domain-probe (2 USDC) when you also care about DNS / well-known discovery for agent-facing sites.
Full catalog
All live kits and APIs: https://product-katalog.restockalarm.workers.dev
Free Workers restock pattern
If you are still learning Workers cron + D1: https://spacecommandkits.hashnode.dev/build-a-free-back-in-stock-alert-with-cloudflare-workers-cron
Shop kits (card/PayPal): https://space-command-kits-shop.fourthwall.com · guest USDC: https://base-usdc-kit-checkout.restockalarm.workers.dev/