http-endpoints — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited http-endpoints (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
HTTP vals (fileType: "http") export a request handler and run on every incoming HTTP request. Each HTTP file is assigned a public live URL — never construct it yourself; read links.endpoint from list_files or create_file responses, or call fetch_val_endpoint.
// Learn more: https://docs.val.town/vals/http/
export default async function (req: Request): Promise<Response> {
return Response.json({ ok: true });
}The file must have an export — export default for the handler.
When using Hono, export app.fetch (not app):
import { Hono } from "npm:hono";
import { parseVal, serveFile } from "https://esm.town/v/std/utils/index.ts";
const app = new Hono();
app.get("/", (c) => c.text("hello"));
// Serve all frontend files, transpiled, with correct content types
app.get("/frontend/**/*", (c) => serveFile(c.req.path));
// View source redirect
app.get("/source", (c) => c.redirect(parseVal().links.self.val));
// Always add this for full stack traces on errors:
app.onError((err) => Promise.reject(err));
export default app.fetch;Hono's serveStatic does not work on Val Town. Use serveFile / staticHTTPServer from std/utils for static files. For the full std/utils API (readFile, serveFile, staticHTTPServer, listFiles, listFilesByPath, httpEndpoint, parseVal, …), fetch https://utilities.val.run/docs.md.
Val Town adds permissive CORS headers by default (Access-Control-Allow-Origin: *), so in 99% of cases, you should never need to do anything with CORS. Using Hono's cors middleware is almost always unnecessary.
If you set any CORS header yourself, Val Town stops adding all default headers — so either handle CORS completely yourself or don't touch it at all.
Response.redirect is broken on Val Town. Use one of:
return new Response(null, { status: 302, headers: { Location: "/path" } });
// or, with Hono:
return c.redirect("/path");std/sqlite or std/blob.For HTML responses, add this script tag to send browser errors back to val logs (visible via get_logs):
<script src="https://esm.town/v/std/catch"></script>After editing an HTTP val, fetch it to confirm it returns the expected HTTP response. Do not report a change as done without this step.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.