Guides

Security badges

Publish an evidence-backed security status without overstating it. Grades appear only for verified domains with current, complete scan evidence.

Badge types

Verified domain · scanned

Free

Available on all plans, including Free, after ownership verification. A grade appears only while the latest complete scan remains current.

SAMPLE · verified scanBoringSec

Verified domain · monitored

Care+

Care or another eligible paid monitoring plan can publish the monitored style when monitoring is enabled and the verified domain has current, complete full-scan evidence.

SAMPLE · monitoredA++

Evidence and freshness states

Current

Verified ownership, complete evidence, and a scan no older than 30 days. The canonical grade may be displayed.

Partial

Coverage is still settling or not assessable. The badge says PARTIAL and withholds the score and grade.

Stale

The full scan or expected monitoring check is overdue. The badge says STALE and withholds the previous grade.

Unverified

No ownership claim has been verified. The public endpoint never publishes a score or grade.

Both theme=light and theme=dark are supported. Use style=full or style=minimal. A monitored badge also becomes stale when its configured monitoring cadence is missed.

Embedding your badge

Markdown (README, docs)

markdown

[![BoringSec](https://www.boringsec.com/api/badge/YOUR_DOMAIN?style=full&theme=light)](https://www.boringsec.com/report/YOUR_TOKEN)

Replace YOUR_DOMAIN with your domain (e.g., myapp.vercel.app).

HTML (website)

html

<a href="https://www.boringsec.com/report/YOUR_TOKEN">
  <img src="https://www.boringsec.com/api/badge/YOUR_DOMAIN?style=full&amp;theme=light"
       alt="BoringSec Security Score" />
</a>

React / Next.js

tsx

<a href="https://www.boringsec.com/report/YOUR_TOKEN"
   target="_blank" rel="noopener noreferrer">
  <img src="https://www.boringsec.com/api/badge/YOUR_DOMAIN?style=minimal&amp;theme=dark"
       alt="BoringSec" height="20" />
</a>

Badge API

The badge endpoint returns an SVG image that can be embedded anywhere.

http

GET /api/badge/myapp.vercel.app?style=full&theme=light

Response: SVG image with an explicit current, partial, stale, unverified, or not-scanned state. Scores are never published for incomplete or unverified evidence.

Caching: Badge refreshes with your latest scan (may be cached up to 1 hour by CDN).

CORS: Badge endpoint allows cross-origin embedding from any domain.

No request auth required: Badge URLs are public, but a score requires server-side ownership verification for that domain.

Badge generator

Visual badge generator

Use the visual badge generator to preview full or minimal styles in light and dark, confirm the evidence state, and copy the embed code.

Open badge generator

Why add a security badge?

Trust signal. Users see a bounded, freshness-aware statement backed by current evidence.

Accountability. A public score motivates you to maintain high security.

Marketing. Every badge is a link to BoringSec — but also to your security report.

Competitive edge. In a world of AI-generated apps, verified security stands out.