The badge
A number you can check, not a promise
A LeakRank badge says one thing: on the day it was issued, we looked at this app from the outside, the way any stranger could, and this is what we found. Anyone can click it and see the same result we did.
Checking someone else’s badge?
Paste the link behind the badge, or the id inside it. You will get the score straight from our records, next to the site it belongs to.
What the score means
Every scan starts at 100. Each thing we can reach from the outside takes points off, and how many depends on how much damage it does. Something that hands a stranger real customer data costs far more than a missing header. The number left over is the score.
Nothing readable was found from the outside. The obvious ways in are closed.
No open data, but real gaps worth closing before more people arrive.
Something a stranger can reach was found. This is the band you fix before launch.
The badge also carries a letter grade, from A+ down to F, for people who read a letter faster than a number.
Try it on a page
This is the badge itself, running. The frame below is a stand-in for your site. Click any of the eight spots to move the badge, hover the circle to see exactly what one of your visitors would see, and try it in dark.
nothing here is a picture: it is the real widget, with a sample score
<script async src="https://leakrank.com/embed/leakrank.js" data-leakrank-id="YOUR_SCAN_ID"></script>One line, once, anywhere in your site. It carries your scan id and nothing else: the number, the grade and the date are read from our records every time the badge loads, so it updates itself when you re-scan and nobody can edit the score by editing the page. No cookies, no tracking script on your visitors.
It answers the question while it is being asked
Someone deciding whether to hand you an email or a card hovers once and gets a plain sentence about what was checked. That is a better answer than a security page nobody opens.
It can be checked, so it counts
Clicking it opens a page on leakrank.com that looks the score up in our records. Anyone can do it, including you, including a customer who does not trust you yet. Evidence beats a claim.
It keeps itself honest
The badge reads the score at load time, so a re-scan updates every page you put it on and you never re-paste anything. Nothing to maintain, and nothing to quietly go stale.
Why the number can be trusted
The badge does not decide the score
The image is just an image. The verification page looks the score up in our records, so editing the picture changes nothing.
Every badge is dated and owned
It belongs to one scan of one site, and the verification page names both. A badge cannot be quietly moved onto a different app.
It can be taken away
A badge that should no longer stand can be revoked, and it stops verifying from that moment.
We tested it, we did not ask
The score comes from checks run against the live site from the outside, not from a questionnaire the owner filled in.
Where to show it
The badge is one line of HTML, so it goes anywhere you can put a link. It is most useful in the moment someone is deciding whether to trust you with their data.
Your site
Footer, pricing page, or wherever people decide whether to hand you their data.
A pitch or a deck
One slide, one number, dated. Easier than explaining your security posture in prose.
Your README or listing
Marketplace listings and open-source READMEs, where trust is decided in seconds.
A reply to a security question
When a customer asks whether you are safe, a link that proves the number beats a promise.
Honest answers
Can someone fake a badge?
They can copy the picture, but not the proof. Every badge links to a verification page on leakrank.com, and that page reads the score from our own records rather than from the badge. If the two disagree, the page wins.
Does a badge mean the app is secure?
It means that on the day of the scan, the checks we run found what the score says they found. It is evidence from a point in time, not a guarantee about everything, and it does not replace a real audit.
What happens when the app changes?
The score belongs to the scan that produced it, so a badge always refers to that moment. Re-scan after a meaningful change and show the new one. A badge can also be revoked, and a revoked badge stops verifying.
Do I have to pay to show a badge?
No. The scan and the score are free, and so is the badge. The paid report is for fixing what the scan found, not for displaying it.
Get your own number
Paste your URL, get a score in about 30 seconds, and take the badge with you. Free, no signup.
Scan my app free →