Guides

Security badges

Publish an evidence-backed security status without overstating it. Grades appear only for verified domains with current, complete scan evidence.

Badge types

Verified domain · scanned

Free

Available on all plans, including Free, after ownership verification. A grade appears only while the latest complete scan remains current.

SAMPLE · verified scanBoringSec

Verified domain · monitored

Care+

Care or another eligible paid monitoring plan can publish the monitored style when monitoring is enabled, its first check has completed, and the verified domain has current, complete full-scan evidence.

SAMPLE · monitoredA++

Evidence and freshness states

Current

Verified ownership, complete evidence, and a scan no older than 30 days. The canonical grade may be displayed.

Partial

Coverage is still settling or not assessable. The badge says PARTIAL and withholds the score and grade.

Stale

The full scan or expected monitoring check is overdue. The badge says STALE and withholds the previous grade.

Unverified

No ownership claim has been verified. The public endpoint never publishes a score or grade.

Both theme=light and theme=dark are supported. Use style=full or style=minimal. A monitored badge also becomes stale when its configured monitoring cadence is missed.

Embedding your badge

Markdown (README, docs)

markdown

[![BoringSec](https://www.boringsec.com/api/badge/YOUR_DOMAIN?style=full&theme=light)](https://www.boringsec.com/score/YOUR_DOMAIN?utm_source=boringsec_badge&utm_medium=referral&utm_campaign=security_badge&utm_content=docs_markdown)

Replace every YOUR_DOMAIN with your domain (e.g., myapp.vercel.app).

The link uses aggregate campaign labels only. It does not add your domain, score, or finding details to analytics properties. The destination is the redacted score card, never a private report link.

HTML (website)

html

<a href="https://www.boringsec.com/score/YOUR_DOMAIN?utm_source=boringsec_badge&amp;utm_medium=referral&amp;utm_campaign=security_badge&amp;utm_content=docs_html">
  <img src="https://www.boringsec.com/api/badge/YOUR_DOMAIN?style=full&amp;theme=light"
       alt="BoringSec Security Score" />
</a>

React / Next.js

tsx

<a href="https://www.boringsec.com/score/YOUR_DOMAIN?utm_source=boringsec_badge&amp;utm_medium=referral&amp;utm_campaign=security_badge&amp;utm_content=docs_react"
   target="_blank" rel="noopener noreferrer">
  <img src="https://www.boringsec.com/api/badge/YOUR_DOMAIN?style=minimal&amp;theme=dark"
       alt="BoringSec" height="20" />
</a>

Badge API

The badge endpoint returns an SVG image that can be embedded anywhere.

http

GET /api/badge/myapp.vercel.app?style=full&theme=light

Response: SVG image with an explicit current, partial, stale, unverified, or not-scanned state. Scores are never published for incomplete or unverified evidence.

Revocation: BoringSec responses are non-cacheable. Turning off public proof makes the badge and score card unavailable on their next request.

CORS: Badge endpoint allows cross-origin embedding from any domain.

No request auth required: Badge URLs are public, but a score requires verified ownership, current complete evidence, and the separate “public badge and shareable score card” consent in domain settings.

Badge generator

Visual badge generator

Use the visual badge generator to preview full or minimal styles in light and dark, confirm the evidence state, and copy the embed code.

Open badge generator

Why add a security badge?

Trust signal. Users see a bounded, freshness-aware statement backed by current evidence.

Accountability. A public score motivates you to maintain high security.

Marketing. Every badge is a link to the owner-approved redacted score card, not the private security report.

Competitive edge. In a world of AI-generated apps, verified security stands out.