JWT Timing Sidechannel

caution grade B Base found on thirdweb found on PayAI confidence 0.32
https://6xrkjcfa3yrzvefcpvanurzou4.srv.us/api/jwt-timing-sidechannel
Claim this service
Advertised description
Paid JWT HS256 signature-timing sidechannel probe (cycle 152, x402 $0.001) - forges 32 HS256 JWTs varying the LAST signature byte, sends each (default 12 iterations) against target's Authorization: Bearer header,…Show more ▾Show less ▴Paid JWT HS256 signature-timing sidechannel probe (cycle 152, x402 $0.001) - forges 32 HS256 JWTs varying the LAST signature byte, sends each (default 12 iterations) against target's Authorization: Bearer header, measures per-byte response timing via stdlib time.monotonic, detects non-constant-time HMAC verification (a classic JWT forgery primitive). Returns per_byte_stats {min_ms,max_ms,median_ms,mean_ms,stdev_ms,range_ms} + overall timing_uniformity_score 0-100 A-F + timing_leak_detected...
(Provider-supplied: an unverified claim, not checked by us. The trust grade above is our independent measurement.)
30-day uptime
100.0%
Avg latency (EU)
1033 ms
slow · measured from a single EU vantage point; includes network round-trip distance to the endpoint; a geographically distant endpoint reads slower even when its server is fast, so it is only lightly weighted in the score
Confidence
0.32
full-density score
Advertised price
$0.01
USDC
Price stability
Stable
last 30 days
Probes (30d)
9
full record · up to 48/day
More details ▾
Endpoint ID299805
Pay on Base$0.01 USDC · to 0xCa0a…500c ↗
First seen2026-10-24
Last probed2026-10-29
Statuslisted
Snapshot computed2026-10-30 04:59 UTC (free snapshot, recomputed at least every 24h)
Why this verdict?1 warning
A wallet payment page opens first; approve the USDC payment and the full JSON report loads right in your browser. Want a taste first? Read a free full sample report.
This page is the free cached snapshot (computed 8 hours ago, refreshed at least every 24h). Here's what the paid API adds.
  • ✓Live re-probe at decision time
    The score is computed the moment you ask, not up to 24h ago.
  • ✓Instant snapshot refresh
    Every paid call rewrites this page, the badge and the card immediately.
  • ✓The full “why”, machine-readable
    Confidence band, component breakdown, every risk flag with its evidence.
  • ✓On-chain settlement proof
    Real USDC volume and distinct payers behind the pay-to wallet.
  • ✓90-day raw history
    Every listing, price and payTo change, every probe result.
  • ✓Ranked better alternatives
    Higher-scored endpoints serving the same function, when they exist.
  • ✓Change & liveness alerts
    PayTo/price moves, spec regressions, downtime; 5-minute probes while watched.
$npx -y x402-trust-mcpGive your agents the tools to do all of this for you, with one install. Agents use the x402_trust_score MCP tool or POST /v1/x402-trust directly (pay-per-call over x402, from $0.005).