I measured 86 paid API endpoints. They fail the same four things.

86 x402 endpoints measured: 75 send no CSP, 59 allow any origin, 18 of 36 DNS zones have no DMARC. Plus a false positive I found in my own audit tool.