Role 03 / production URL audit

Scan URLs like production traffic.

A public URL goes in. A bounded, cached, rate-limited audit comes back with the failures that matter first.

This work avoids the demo trap. The UI stays quiet while the service shows the harder parts: SSRF defense, request IDs, structured errors, queue pressure and cache behavior.

Start scan Read API contract

Run scan

Enter any public http or https URL. Private and loopback addresses are rejected before a socket opens.

Try:

What to fix first

API contract

Full reference in the repository README. Every response carries an x-request-id header; quote it when reporting a problem.

# Audit a URL
curl -X POST https://page-pulse-9riw.onrender.com/v1/audit \
  -H 'content-type: application/json' \
  -d '{"url":"https://example.com"}'

# Same thing, GET, bypassing the cache
curl 'https://page-pulse-9riw.onrender.com/v1/audit?url=example.com&fresh=true'

Endpoint	Purpose
`POST /v1/audit`	Audit a URL. Body: `url`, optional `fresh`, optional `ttlSeconds`.
`GET /v1/audit`	Same audit via query string, for links and browsers.
`GET /v1/stats`	Cache hit rate, in-flight audits, queue depth, tracked rate-limit clients.
`GET /healthz`	Liveness. Never rate limited.
`GET /readyz`	Readiness. Returns 503 once the work queue is saturated.