Read-only audit of whether a DSH plugin's HTTP routes are actually fenced. Discovers the routes installed plugins really register by reading their code, then issues unauthenticated, cross-port-Origin and cross-site-Origin GET probes against loopback only, reporting fenced / open / absent / unknown with the status codes observed. Each finding also carries static fence evidence with line numbers, which can only soften a verdict, never harden one, so a maintainer who did add a fence is never reported as careless.
This plugin has not published an npm package, so the store does not offer an install command yet. Use the repository link below to view the source.