The badge
A number you can check, not a promise
A LeakRank badge says one thing: on the day it was issued, we looked at this app from the outside, the way any stranger could, and this is what we found. Anyone can click it and see the same result we did.
Checking someone else’s badge?
Paste the link behind the badge, or the id inside it. You will get the score straight from our records, next to the site it belongs to.
What the score means
Every scan starts at 100. Each thing we can reach from the outside takes points off, and how many depends on how much damage it does. Something that hands a stranger real customer data costs far more than a missing header. The number left over is the score.
Nothing readable was found from the outside. The obvious ways in are closed.
No open data, but real gaps worth closing before more people arrive.
Something a stranger can reach was found. This is the band you fix before launch.
The badge also carries a letter grade, from A+ down to F, for people who read a letter faster than a number.
Why the number can be trusted
The badge does not decide the score
The image is just an image. The verification page looks the score up in our records, so editing the picture changes nothing.
Every badge is dated and owned
It belongs to one scan of one site, and the verification page names both. A badge cannot be quietly moved onto a different app.
It can be taken away
A badge that should no longer stand can be revoked, and it stops verifying from that moment.
We tested it, we did not ask
The score comes from checks run against the live site from the outside, not from a questionnaire the owner filled in.
Where to show it
The badge is one line of HTML, so it goes anywhere you can put a link. It is most useful in the moment someone is deciding whether to trust you with their data.
Your site
Footer, pricing page, or wherever people decide whether to hand you their data.
A pitch or a deck
One slide, one number, dated. Easier than explaining your security posture in prose.
Your README or listing
Marketplace listings and open-source READMEs, where trust is decided in seconds.
A reply to a security question
When a customer asks whether you are safe, a link that proves the number beats a promise.
Honest answers
Can someone fake a badge?
They can copy the picture, but not the proof. Every badge links to a verification page on leakrank.com, and that page reads the score from our own records rather than from the badge. If the two disagree, the page wins.
Does a badge mean the app is secure?
It means that on the day of the scan, the checks we run found what the score says they found. It is evidence from a point in time, not a guarantee about everything, and it does not replace a real audit.
What happens when the app changes?
The score belongs to the scan that produced it, so a badge always refers to that moment. Re-scan after a meaningful change and show the new one. A badge can also be revoked, and a revoked badge stops verifying.
Do I have to pay to show a badge?
No. The scan and the score are free, and so is the badge. The paid report is for fixing what the scan found, not for displaying it.
Get your own number
Paste your URL, get a score in about 30 seconds, and take the badge with you. Free, no signup.
Scan my app free →