Is alpaca.markets safe to use as a vendor?

alpaca.markets scored 78/100 on LynxRadar's security posture assessment. The domain partially meets security requirements with some gaps to address. 4 checks passed, 3 warnings, 1 critical issues across 8 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

Does alpaca.markets have security headers configured?

alpaca.markets has 0 of 5 recommended security headers. Missing: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.

alpaca.markets Security Report — Grade C+ (78/100)

Q: What TLS version does alpaca.markets use?

alpaca.markets uses TLSv1.3 with TLS_AES_256_GCM_SHA384. TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Q: Does alpaca.markets have DMARC configured?

Yes. alpaca.markets's DMARC policy is set to 'quarantine'. SPF record: yes. Strengths: DMARC policy set to quarantine; SPF record present with hard-fail (-all); DKIM configured (selectors: google, s1, s2, zendesk1, zendesk2).

Q: Does alpaca.markets use HSTS?

Partially. HSTS present but max-age is low (15724800s). Recommended minimum: 15768000 (6 months).

Q: Is alpaca.markets's SSL certificate valid?

Issues detected. Strengths: Certificate valid, 31 days remaining; Issued by Google Trust Services. Issues: Wildcard certificate in use — broader attack surface if compromised.

Q: Does alpaca.markets have DNSSEC enabled?

No. Strengths: 2 nameservers configured (carol.ns.cloudflare.com., trey.ns.cloudflare.com.); 5 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.

C+ 78/100

alpaca.markets

February 18, 2026 ·

1+ Warnings 4 Passed

AI Summary

alpaca.markets scored 78/100, meeting baseline requirements but with 3 findings that require attention. The vendor can proceed with a remediation timeline agreement.

Critical gaps in: Security Headers. Positive signals: Known Breaches, TLS Configuration, CVE Exposure all passed.

4 action items identified, including 0 critical. The issues are configuration gaps, not architectural problems. A focused remediation effort of 2–5 days could address all findings.

Better than 59% of 2692 companies scanned.

059th pct100

A+

A-

B+

B-

C+

C-

D+

D-

C+

alpaca.markets

78/100

Add missing security headers (CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy)

1–2 hours

5 of 5 recommended security headers are missing on alpaca.markets: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy. These headers protect against clickjacking, MIME-sniffing, and unauthorized browser feature access. Adding them is a server configuration change with no application code changes required.

PCI-DSS 4.0Req 6.4.1

Security headers are required application controls

OWASPSecure Headers

Recommended baseline for web applications

How to fix this

1Add Content-Security-Policy header (start with report-only to avoid breakage)

2Add: X-Content-Type-Options: nosniff

3Add: X-Frame-Options: DENY (or SAMEORIGIN if you use iframes)

4Add: Referrer-Policy: strict-origin-when-cross-origin

5Add: Permissions-Policy: camera=(), microphone=(), geolocation=()

At a glance

Full data from this scan

TLS Version

TLSv1.3

TLSv1.3 negotiated with TLS_AES_256_GCM_SHA384 (256-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

DMARC Policy

p=quarantine

Strengths: DMARC policy set to quarantine; SPF record present with hard-fail (-all); DKIM configured (selectors: google, s1, s2, zendesk1, zendesk2).

SPF Record

Present

v=spf1 include:_spf.google.com include:mail.zendesk.com include:amazonses.com include:7664709.spf08.

Security Headers

0/5 present

Missing: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy

HSTS

Not enabled

HSTS present but max-age is low (15724800s). Recommended minimum: 15768000 (6 months).

SSL Certificate

Issues

Strengths: Certificate valid, 31 days remaining; Issued by Google Trust Services. Issues: Wildcard certificate in use — broader attack surface if compromised.

DNSSEC

Not enabled

Strengths: 2 nameservers configured (carol.ns.cloudflare.com., trey.ns.cloudflare.com.); 5 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.

Similar companies