Cometh Domain Security

generated: '2026-08-17'
method: probed
source: live DNS/TLS/HTTP probes of apis.yml + OpenAPI hosts
hosts:
- host: www.cometh.io
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct 11 02:01:48 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: docs.cometh.io
  https: true
  tls_version: TLSv1.3
  cert_expires: Nov 15 06:59:42 2026 GMT
  hsts: true
  hsts_max_age: 31536000
- host: api.4337.cometh.io
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 22 22:50:11 2026 GMT
  hsts: null
- host: bundler.cometh.io
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 21 03:40:52 2026 GMT
  cert_cn: bundler.cometh.io
  hsts: null
  http_status: 404
  note: 'Kong gateway; unmatched paths return {"message":"no Route matched with those values"}.'
- host: paymaster.cometh.io
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep 20 03:40:14 2026 GMT
  cert_cn: paymaster.cometh.io
  hsts: null
  http_status: 401
  note: 'Kong key-auth; every path returns {"message":"No API key found in request"} until an apikey is supplied.'
- host: status.cometh.io
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct 14 18:53:03 2026 GMT
  hsts: true
  hsts_max_age: 63113904
  hsts_preload: true
  http_status: 200
- host: security.cometh.io
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct  9 14:58:35 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  http_status: 200
  note: Vanta-hosted trust centre.
- host: app.cometh.io
  https: true
  tls_version: TLSv1.3
  cert_expires: Oct 11 07:51:44 2026 GMT
  hsts: null
  http_status: 200
  note: Project dashboard where apikey/apisecret are issued; serves no HSTS header.
- host: api.marketplace.cometh.io
  https: false
  tls_version: null
  tls_error: 'CERTIFICATE_VERIFY_FAILED: self-signed certificate'
  cert_subject: 'C=US, ST=California, L=San Francisco, O=Kong, OU=IT Department, CN=localhost'
  cert_issuer: 'C=US, ST=California, L=San Francisco, O=Kong, OU=IT Department, CN=localhost'
  cert_valid: 2026-08-16 to 2046-08-11
  hsts: null
  note: >-
    HOST IS BROKEN FOR TLS. The name resolves (CNAME entrypoint.core.cometh.tech) but the gateway answers with Kong's
    DEFAULT self-signed localhost certificate, so no client can verify it; with verification disabled the gateway
    returns 404 "no Route matched with those values". The still-published @cometh/marketplace-sdk targets this host —
    see lifecycle/cometh-lifecycle.yml.
- host: api.checkout.cometh.io
  https: false
  tls_version: null
  tls_error: 'CERTIFICATE_VERIFY_FAILED: self-signed certificate'
  cert_subject: 'O=Kong, CN=localhost (default certificate)'
  hsts: null
  note: Same failure mode as api.marketplace.cometh.io; targeted by the still-published @cometh/checkout-sdk.
domains:
- domain: cometh.io
  dnssec: true
  caa: []
  spf: true
  dmarc: true
  dmarc_policy: none
  note: >-
    DNSSEC is signed and SPF/DMARC exist, but the DMARC policy is p=none (monitor only, no enforcement) and NO CAA
    record is published, so any public CA may issue for the domain.
x-findings:
- 'Two API hostnames (api.marketplace, api.checkout) present Kong''s default self-signed localhost certificate — unusable over TLS.'
- 'No CAA record on cometh.io; DMARC is p=none.'
- 'No HSTS on the three live API hosts (api.4337, bundler, paymaster) nor on the app.cometh.io dashboard.'