Public routes do not require an API key. Each route has its own rate limit and Cross-Origin Resource Sharing (CORS) behavior.

​
Route map

​
Current IP

​
Browser access

FullHunt does not enable blanket CORS for every API route. CORS is explicitly enabled on selected browser-safe routes, including general search suggestions and the public 0day.today archive search. Other public routes may be callable from a server but unavailable to arbitrary browser origins. The hosted MCP proxy implements its own wildcard CORS and preflight behavior for MCP transport clients. That behavior does not apply to the REST API as a whole.