Measured.
Not typed.
Securemark scans your website and GitHub repository on a schedule, scores the results against a public methodology, and serves the proof as a tiny SVG from the edge. No self-declared green badges. No black boxes.
Scanner → score → SVG.
Three stages, each auditable. The badge is just the last, smallest step.
Scanners run on a schedule
Headers over HTTPS, a real TLS handshake, DNS-over-HTTPS lookups. Jobs are queued in Postgres and executed by isolated runners with SSRF guards and a clear user-agent.
Scored by public rules
Every metric has published weights and thresholds. Results are stored with the methodology version that produced them, so a grade never silently changes meaning.
Served as SVG at the edge
Cloudflare Workers render the latest stored result with ETags and long-lived caching. Accessible titles, light and dark themes, and a timestamp you can see.
Paste a domain. Get a badge.
Type any public domain or owner/repo. The URLs and snippet update live, and the previews are real requests to the badge API.
website → securemark.dev · * Pro styles
[](https://www.securemark.dev/methodology/) [](https://www.securemark.dev/methodology/) [](https://www.securemark.dev/methodology/) [](https://www.securemark.dev/methodology/)
These are live requests to securemark.dev. Unscanned subjects show pending. Add and verify the site in the dashboard to start scheduled scans; repository badges arrive with the GitHub App.
Six styles. Two themes. One source of truth.
Free projects get classic, flat and pill. Pro unlocks gradient, icon, detailed and custom labels.
Website security, performance, infrastructure & repos.
Security headers
HSTS, CSP, nosniff, framing, Referrer-Policy, Permissions-Policy and COOP, scored 0–100 and graded A+ to F.
TLS expiry
Days until your certificate expires, plus validity and protocol. Turns amber under 30 days, red under 14.
DNS & email
SPF, DMARC policy, DNSSEC, CAA and IPv6, read over DNS-over-HTTPS.
Overall security grade
Weighted roll-up of every measurable category. Under 50% measurable means INSUFFICIENT DATA, never a free pass.
Core Web Vitals (field)
LCP, INP and CLS at p75 from real Chrome users (CrUX, 28-day window). Never blended with lab data.
Lighthouse (lab)
Performance, accessibility, best-practices and SEO lab scores via PageSpeed Insights.
Uptime
Daily on Free, every 5 minutes on Pro, every minute on Team.
Build status
Latest default-branch workflow run, delivered by the read-only GitHub App.
If it can't be measured, it says so.
Badges are only worth something if the rules are public. Ours are versioned, and old results keep the version they were scored under.
Unavailable is never clean
Missing data is shown as INSUFFICIENT DATA, never as a pass. Under 50% measurable weight means no overall grade.
Field ≠ lab
Real-user Core Web Vitals and Lighthouse lab scores are reported separately and never blended.
Every badge is dated
The measured time and methodology version travel with the result, so you can see exactly what a badge means.
Published weights
Headers 15 · TLS 20 · Vulns 25 · DNS 10 · AppSec 20 · Supply chain 10. Grades A+ ≥95 through F <60.
Free for public projects. £4 when it matters.
Pay per project, not per seat. Prices include UK VAT where applicable.
For public projects that want honest proof.
- 3 projects, 5 badges each
- Public repos and sites
- Daily refresh
- classic · flat · pill styles
- 30 days of history
- Read API (rate-limited)
Pay only for the projects that matter. £40/yr per project.
- Unlimited badges per project
- Private repos
- Hourly refresh (TLS every 6 h)
- All 6 styles + custom labels
- 13 months of history + trends
- Email, Slack and webhook alerts
- 5-minute uptime checks
- Active scans on verified domains
- Securemark mark removed
Up to 15 projects, then £2 each. For agencies and orgs.
- Everything in Pro
- 1-minute uptime checks
- Org branding on badges
- Shared alert channels
- History export
- Full API access
- SSO (coming later)
Questions, answered plainly.
Why not just use shields.io?
Shields renders whatever a third-party API says, and many badges are simply typed by the repo owner. Securemark runs its own scanners, scores results with a versioned public methodology, and every badge carries the time it was measured and the methodology version that produced it.
Can someone put a badge for my site on theirs?
Passive, public checks (headers, TLS, DNS) work for any public domain, as with any public scanner. Ownership-gated features such as active scans, private data and the verified mark need a DNS TXT record (_securemark.yourdomain) proving you control the domain.
What happens when something can't be measured?
It says so. Missing data shows INSUFFICIENT DATA, never a pass. If less than half of an overall grade's weight is measurable, there's no grade at all.
How fresh are the badges?
Badges are served from the latest stored result at the edge and never trigger a scan on request. Free refreshes daily; Pro hourly (TLS every 6 hours). Each badge's detailed style and tooltip shows when it was measured.
Will badges slow my README or site?
No. They're tiny SVGs served from Cloudflare's edge with ETags and stale-while-revalidate caching, so GitHub's image proxy and browsers get a cached response almost every time.
Do you need access to my code?
Not for website badges. Repository badges use a read-only GitHub App with least-privilege permissions; private repos need Pro.
How does billing work?
Stripe Checkout and the Stripe Customer Portal. Pro is a single subscription whose quantity is the number of Pro projects; change it any time with proration, or cancel at period end. Prices include UK VAT where applicable.
Is my data sold or tracked?
No. This site sets no cookies and loads no trackers or external fonts. The dashboard uses a session cookie only for sign-in. See the privacy policy.