{
  "url": "http://github.com/",
  "method": "GET",
  "hops": [
    {
      "url": "http://github.com/",
      "method": "GET",
      "addr": "20.26.156.215:80",
      "status": 301,
      "status_text": "Moved Permanently",
      "proto": "HTTP/1.1",
      "location": "https://github.com/",
      "headers": [
        {
          "name": "Content-Length",
          "value": "0"
        },
        {
          "name": "Location",
          "value": "https://github.com/"
        }
      ],
      "timing": [
        {
          "name": "dns",
          "ms": 13.792
        },
        {
          "name": "connect",
          "ms": 12.59
        },
        {
          "name": "tls",
          "ms": 0
        },
        {
          "name": "ttfb",
          "ms": 12.273
        },
        {
          "name": "download",
          "ms": 0.009
        }
      ],
      "total_ms": 39.158,
      "total": "39 ms",
      "body_bytes": 0
    },
    {
      "url": "https://github.com/",
      "method": "GET",
      "addr": "20.26.156.215:443",
      "status": 200,
      "status_text": "OK",
      "proto": "HTTP/2.0",
      "tls_version": "TLS 1.3",
      "cipher": "TLS_AES_128_GCM_SHA256",
      "content_type": "text/html; charset=utf-8",
      "content_encoding": "gzip",
      "headers": [
        {
          "name": "Accept-Ranges",
          "value": "bytes"
        },
        {
          "name": "Cache-Control",
          "value": "max-age=0, private, must-revalidate"
        },
        {
          "name": "Content-Encoding",
          "value": "gzip"
        },
        {
          "name": "Content-Language",
          "value": "en-US"
        },
        {
          "name": "Content-Security-Policy",
          "value": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net productionresultssa30.blob.core.windows.net productionresultssa31.blob.core.windows.net productionresultssa32.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com wss://production-copilot-host-centralus.webpubsub.azure.com wss://production-copilot-host-centralus-02.webpubsub.azure.com wss://production-copilot-host-westus.webpubsub.azure.com api.github.com/cmc_internal/api/ edge.fullstory.com rs.fullstory.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com *.googleusercontent.com objects-origin.githubusercontent.com *.githubusercontent.com images.ctfassets.net/8aevphvgewt8/; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/; script-src github.githubassets.com 'sha256-6AKuI+cDd1MoUL1u4eqrA9PXmnPAkOB4h7421hPUUm0='; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/"
        },
        {
          "name": "Content-Type",
          "value": "text/html; charset=utf-8"
        },
        {
          "name": "Date",
          "value": "Thu, 29 Oct 2026 16:56:00 GMT"
        },
        {
          "name": "Etag",
          "value": "W/\"a09e5aafaecf306c71c78ec594b63759\""
        },
        {
          "name": "Referrer-Policy",
          "value": "origin-when-cross-origin, strict-origin-when-cross-origin"
        },
        {
          "name": "Server",
          "value": "github.com"
        },
        {
          "name": "Set-Cookie",
          "value": "_gh_sess=EVONd50fTpBdjC3NMZKPh9XY66Pz9scasgksZJ%2FLHGvsT%2BSb5mzSMFEcz3iQImSaeDOLmpBs52tnIEceQ7ahDXm8Eb97r%2FnEJo8znEyCYFI8q2Rd4mhGjxfkaNa5oPR2ZXdOoopgOac%2BB4Oti1rPJnp%2BA4WBmvBNfg65RTuAZwP%2Flse%2FCU%2BDIu3vFFJoUeMyzt4xUnCSn8DNKMaL%2BNBXkRU6InAYtQ7zqFaeBrckFi0gooslR%2FvrxqF7aoqntUPwA4NLncE6cEhVT4fz899oXw%3D%3D--F9d118Bi1ruqKLVq--vA1Z8A%2F26Ib8tDmBlwON2Q%3D%3D; path=/; HttpOnly; secure; SameSite=Lax"
        },
        {
          "name": "Set-Cookie",
          "value": "_octo=GH1.1.729545296.1793292969; expires=Fri, 29 Oct 2027 16:56:09 GMT; domain=.github.com; path=/; secure; SameSite=Lax"
        },
        {
          "name": "Set-Cookie",
          "value": "logged_in=no; expires=Fri, 29 Oct 2027 16:56:09 GMT; domain=.github.com; path=/; HttpOnly; secure; SameSite=Lax"
        },
        {
          "name": "Strict-Transport-Security",
          "value": "max-age=31536000; includeSubdomains; preload"
        },
        {
          "name": "Vary",
          "value": "X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, X-GitHub-Client-Version, Accept-Language, Sec-Fetch-Site,Accept-Encoding, Accept, X-Requested-With"
        },
        {
          "name": "X-Content-Type-Options",
          "value": "nosniff"
        },
        {
          "name": "X-Frame-Options",
          "value": "deny"
        },
        {
          "name": "X-Github-Edge-Region",
          "value": "uksouth"
        },
        {
          "name": "X-Github-Request-Id",
          "value": "D5F8:354D7F:12C92D5:1B34979:6AE37AA9"
        },
        {
          "name": "X-Xss-Protection",
          "value": "0"
        }
      ],
      "timing": [
        {
          "name": "dns",
          "ms": 17.634
        },
        {
          "name": "connect",
          "ms": 13.149
        },
        {
          "name": "tls",
          "ms": 29.81
        },
        {
          "name": "ttfb",
          "ms": 12.461
        },
        {
          "name": "download",
          "ms": 30.154
        }
      ],
      "total_ms": 104.018,
      "total": "104 ms",
      "body_bytes": 92652
    }
  ],
  "redirects": 1,
  "total_ms": 143.176,
  "total": "143 ms",
  "proto": "HTTP/2.0",
  "http3_advertised": false,
  "compression": "gzip",
  "grade": "B",
  "checks": [
    {
      "name": "Strict-Transport-Security",
      "status": "pass",
      "value": "max-age=31536000; includeSubdomains; preload",
      "note": "Browsers that have seen this will refuse to load the site over plain HTTP."
    },
    {
      "name": "Content-Security-Policy",
      "status": "pass",
      "value": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; conn...",
      "note": "Policy is enforced and script sources are restricted."
    },
    {
      "name": "Framing",
      "status": "pass",
      "value": "frame-ancestors 'none'",
      "note": "CSP frame-ancestors controls which sites may embed this page. It supersedes X-Frame-Options."
    },
    {
      "name": "X-Content-Type-Options",
      "status": "pass",
      "value": "nosniff",
      "note": "Browsers will trust the declared Content-Type rather than guessing, which blocks a class of script-injection tricks."
    },
    {
      "name": "Referrer-Policy",
      "status": "pass",
      "value": "origin-when-cross-origin, strict-origin-when-cross-origin",
      "note": "Limits how much of the URL other sites learn when a user follows a link."
    },
    {
      "name": "Permissions-Policy",
      "status": "warn",
      "value": "missing",
      "note": "Optional but recommended. Turning off features the page does not need (camera=(), microphone=(), geolocation=()) limits what a compromised script or third-party frame can do.",
      "guide": "https://kirkdiamond.com/guides/security-headers"
    },
    {
      "name": "Cross-Origin-Opener-Policy",
      "status": "info",
      "value": "missing",
      "note": "Not essential for most sites. same-origin is worth adding if the page handles logins or sensitive data.",
      "guide": "https://kirkdiamond.com/guides/security-headers"
    },
    {
      "name": "Server disclosure",
      "status": "pass",
      "value": "Server: github.com",
      "note": "A product name without a version is fine."
    },
    {
      "name": "Cookies",
      "status": "warn",
      "value": "3 set, 1 attribute warnings",
      "note": "Cookies are Secure but some lack HttpOnly or SameSite. HttpOnly keeps them away from scripts; SameSite limits cross-site request forgery.",
      "guide": "https://kirkdiamond.com/guides/security-headers"
    }
  ],
  "cookies": [
    {
      "name": "_gh_sess",
      "path": "/",
      "secure": true,
      "http_only": true,
      "same_site": "Lax",
      "expires": "session",
      "set_by_hop": 2
    },
    {
      "name": "_octo",
      "domain": ".github.com",
      "path": "/",
      "secure": true,
      "http_only": false,
      "same_site": "Lax",
      "expires": "2027-10-29T16:56:09Z",
      "issues": [
        "no HttpOnly flag"
      ],
      "set_by_hop": 2
    },
    {
      "name": "logged_in",
      "domain": ".github.com",
      "path": "/",
      "secure": true,
      "http_only": true,
      "same_site": "Lax",
      "expires": "2027-10-29T16:56:09Z",
      "set_by_hop": 2
    }
  ]
}