What problem does it solve? Security testers need a safe, structured way to assess whether a server correctly enforces HTTP/2 protocol limits (streams, headers, continuation frames, priority) without triggering denial-of-service conditions or producing false positives from CDN edge behavior. ## Core Features & Use Cases - Evidence-Gated Validation: Enforces a fixed baseline → single-variable probe → post-baseline → oracle → evidence workflow so every finding is backed by monitor, log, or vendor advisory proof. - Strict Safety Boundaries: Prohibits stream floods, continuation floods, connection exhaustion, and request smuggling payloads; WAF hits, timeouts, and scanner alerts are treated as INCONCLUSIVE rather than vulnerabilities. - Routing Integration: Hands off request-boundary issues to an HTTP smuggling skill and CVE-specific checks to a bug bounty methodology skill. - Use Case: During an authorized assessment, confirm whether HTTP/2 is enabled end-to-end (not just at the CDN edge), read ALPN/SETTINGS and server limits, and verify against vendor advisories whether the deployed version enforces documented protocol quotas. ## Quick Start Use $hunt-http2-limits to plan an evidence-gated, authorized validation of HTTP/2 stream and header limits on my staging gateway.
