SecurityTrails vs Shodan

SecurityTrails 0

No x402, MPP or L402 (0). securitytrails.com/app/pricing and /corp/pricing answered a Cloudflare challenge, and the docs name no price, so no public price was read (0). Whether a free plan exists couldn't be confirmed; the usage endpoint shows only that each account has a monthly allowance (0). A key comes from a browser signup on securitytrails.com, with no programmatic route found (0). 0 + 0 + 0 + 0 = 0, scored as Contentful and Personio were on 7 October 2026 when their pricing pages were unreadable.

Shodan 40

No x402, MPP or L402 (0). Plan prices and credit quotas are public on the billing page without a login, from a $49 one-time Membership to $1,099 a month, sold by monthly credit quota rather than per call (10). A free account with a free API plan, and the billing page does not ask for a card (20). The REST API key comes from a browser signup. InternetDB and CVEDB answer with no account or key at all, for non-commercial use, which is keyless use of part of the surface (10 of 20). 0 + 10 + 20 + 10 = 40.

SecurityTrails 20

Read with the hosted lines. status.securitytrails.com redirects to securitytrails.statuspage.io, which says it is inactive and visible to team members only, so no public status page (0) and no readable history (5). No rate limit numbers in the readable docs; the pricing page, which may carry them, answered a Cloudflare challenge (0). 429 is documented on the ping page with the message 'API rate limit exceeded' and no Retry-After or backoff guidance, and every v1 call is a read (5 of 15). No SLA found (0). The v1 API is live and not marked beta, though every operation id carries an '-old' suffix with deprecated set to false (10). 0 + 5 + 0 + 5 + 0 + 10 = 20.

Shodan 40

Read with the hosted lines. A public status page exists at status.shodan.io (UptimeRobot), but on 3 November 2026 its component list failed to load and it showed only that there were no updates in the last 7 days, so no component history was readable (10 of 20). No readable incident record for the 90 days (5). The billing page states that all API plans are limited to 1 request a second, and credits per plan are published with numbers (15). No 429, Retry-After or backoff guidance was found in the reference or the OpenAPI document; the only error statement is that a non-200 status carries an error message, and no idempotency keys exist for alert, notifier or scan writes. The official Python client throttles itself to 1 request a second and retries a timed-out search cursor, which is client behaviour, not an API contract (0). No SLA found on the billing, enterprise or developer pages (0). The REST API is generally available (10). 10 + 5 + 15 + 0 + 0 + 10 = 40.

SecurityTrails 32

One API key with no scopes found, accepted as an APIKEY header or as apikey in the query string, which the reference pages show on every v1 endpoint (20 less 10, so 10). Revocation and rotation couldn't be read. The v1 API is read-only by the overview's own statement; the ASI API writes tags with no approval step (14 of 20). DNS TXT values, WHOIS fields and user agent strings are third-party text, with no guidance on treating them as untrusted (5 of 15). /v1/account/usage reports monthly counts and nothing per call (3 of 15). security.txt on securitytrails.com and the security page are behind the Cloudflare challenge, api.securitytrails.com answers security.txt with 401, and no disclosure policy, bug bounty or certification was readable (0 of 20). 10 + 14 + 5 + 3 + 0 = 32.

Shodan 19

One key per account with no scopes, sent as key= in the query string on every documented call and in the OpenAPI document, with no header option. Read as a plain key, the way the Alpha Vantage listing was read, less 10 for the query string (10 of 30). No read-only key or least-privilege mode; the free plan's limits are quotas, not scopes, and alerts, notifiers and org members can be deleted with the same key and no confirmation (3 of 20). Results carry banners, HTTP titles and page bodies collected from arbitrary hosts, and no guidance on treating them as untrusted was found (3 of 15). /api-info reports the plan and credits, and no call log for the key holder was found (3 of 15). security.txt returns 404 on www.shodan.io, and no bug bounty, disclosure policy, SOC 2 or ISO 27001 was found on the pages read (0 of 20). 10 + 3 + 3 + 3 + 0 = 19.

SecurityTrails 32

A closed service whose terms couldn't be read because of the Cloudflare challenge (5 of 30, for a known commercial product with unread terms). The privacy policy was unread and no retention statement or DPA was found (0 of 30). No deprecation policy; the operation ids carry '-old' with deprecated set to false and no notice explains them (0 of 20). No subprocessor or data location statement readable (0 of 20). 5 + 0 + 0 + 0 = 5.

Shodan 44

Editorial half. A closed service whose terms at static.shodan.io/legal/terms.html were not read, because that host answers 403 to robots.txt, so their clarity can't be assessed; the Python library is MIT (5 of 30). The privacy policy at account.shodan.io/privacy carries no date, names no legal entity, retention period, data location or subprocessor, and says Shodan may share information with advertisers, business partners, sponsors and other third parties (5 of 30). The help centre says export credits are deprecated and no longer sold, with no date; no deprecation policy found (3 of 20). No subprocessors or data locations disclosed (0 of 20). 5 + 5 + 3 + 0 = 13.

SecurityTrails 5

The newest dated changelog entry is 28 May 2020, the Project API 1.7.0 entry is undated and the SurfaceBrowser changelog ends on 26 February 2019, so no change within 180 days was found (0 of 30). No entries in the last 90 days (0). A public changelog exists but is five years stale, and the support page is disallowed by robots.txt (3 of 25). No official SDK; the npm package of October 2021 names the vendor as author with no repository (0 of 15). The docs site serves llms.txt and Markdown twins, which shows the documentation platform is current (2 of 10). 0 + 0 + 3 + 0 + 2 = 5.

Shodan 16

No dated API change found. The blog's newest post is 7 August 2024, and the official Python library shodan 1.31.0 was published on 17 December 2023 with the repository's last push on 5 August 2024 (0 of 30). No releases or dated changelog entries in the last 90 days (0 of 20). 63 open issues on the Python repository with no push since August 2024; a support email and a help centre exist (5 of 25). The official Python SDK still installs but is two years old, and the other clients are community work (8 of 15). The repository has no CI configuration and no CHANGELOG entry since 1.28.0 of July 2022 (3 of 10). 0 + 0 + 5 + 8 + 3 = 16.

SecurityTrails 54

The reference pages are generated from an OpenAPI document (operation ids, deprecated flags and typed schemas show on each page), but no spec is published for download and docs.securitytrails.com/openapi redirects to 404 (12 of 25). llms.txt with a Markdown twin of every page (10). Each endpoint has a one-line purpose and nothing on when to use it or not (8 of 20). Path and query parameters are typed, the DNS history type is an enum of six values, and the ASI API has enums, operators and a 1 to 1,000 limit, but the v1 filter object is untyped strings and the DSL query is a free string whose grammar isn't documented (8 of 15). Example responses on every page, with errors mostly limited to 400 and a message, 401 and 429 only on the ping page and 422 on the ASI API (8 of 15). Versioned paths (/v1, /v2) and a changelog whose dated entries stop on 28 May 2020, with one undated Project API 1.7.0 entry (8 of 15). 12 + 10 + 8 + 8 + 8 + 8 = 54.

Shodan 46

The surface graded is the REST API at api.shodan.io. An OpenAPI 3.0.0 document at developer.shodan.io/api/openapi.json covers 37 paths and 44 operations, but declares no securitySchemes, no enums and a non-200 response on one operation only (15 of 25). No llms.txt on developer.shodan.io or www.shodan.io, both 404, and no Markdown docs served for agents (0 of 10). Every operation carries a description, and the reference says which calls cost credits and which plans can scan, with little on when not to use a call (12 of 20). Required flags on the key and path parameters, with facets, query and fields as free strings and no enums or constraints (7 of 15). Example requests and responses for every endpoint in the reference, and errors documented only as a non-200 status with an error field (9 of 15). No version in the path, the OpenAPI document says 1.0.0, and the only dated record of changes is the blog, whose newest post is 7 August 2024 (3 of 15). 15 + 0 + 12 + 7 + 9 + 3 = 46.