catalogue
Badge catalogue
Live badges are being served now. "Soon" badges are on the roadmap, and their URLs already return a pending badge so you can wire them up early.
Website security
| Badge | What it measures | URL | Status |
|---|---|---|---|
| Security headers | HSTS, CSP, nosniff, framing, Referrer-Policy, Permissions-Policy and COOP, scored 0–100 and graded A+ to F. | /security-headers/example.com.svg | Live |
| TLS expiry | Days until your certificate expires, plus validity and protocol. Turns amber under 30 days, red under 14. | /tls-expiry/example.com.svg | Live |
| Overall security grade | Weighted roll-up of every measurable category. Under 50% measurable means INSUFFICIENT DATA, never a free pass. | /security/example.com.svg | Soon |
Performance
| Badge | What it measures | URL | Status |
|---|---|---|---|
| Core Web Vitals (field) | LCP, INP and CLS at p75 from real Chrome users (CrUX, 28-day window). Never blended with lab data. | /cwv/example.com.svg | Soon |
| Lighthouse (lab) | Performance, accessibility, best-practices and SEO lab scores via PageSpeed Insights. | /lighthouse/example.com.svg | Soon |
Infrastructure
| Badge | What it measures | URL | Status |
|---|---|---|---|
| DNS & email | SPF, DMARC policy, DNSSEC, CAA and IPv6, read over DNS-over-HTTPS. | /dns/example.com.svg | Live |
| Uptime | Daily on Free, every 5 minutes on Pro, every minute on Team. | /uptime/example.com.svg | Soon |
Repository
| Badge | What it measures | URL | Status |
|---|---|---|---|
| Build status | Latest default-branch workflow run, delivered by the read-only GitHub App. | /build/owner/repo.svg | Soon |
| Known vulnerabilities | OSV severity counts from your lockfiles: critical, high, medium, low. | /vulns/owner/repo.svg | Soon |
| Coverage | From real lcov / Cobertura reports uploaded by the coverage Action. Not self-declared. | /coverage/owner/repo.svg | Soon |
| Release | Latest release tag and age. | /release/owner/repo.svg | Soon |
| Licence | SPDX licence detected from the repository. | /license/owner/repo.svg | Soon |
Supply chain
| Badge | What it measures | URL | Status |
|---|---|---|---|
| SLSA provenance | Build attestations on releases, verified against GitHub's attestation API. | /slsa/owner/repo.svg | Later |
url format
One URL, three knobs.
https://securemark.dev/{metric}/{domain}.svg
https://securemark.dev/{metric}/{owner}/{repo}.svg
https://securemark.dev/badge/{project}/{metric}.svg
?style=classic|flat|pill|gradient|icon|detailed (default flat)
?theme=light|dark
?label=Custom%20label (Pro)Aliases: /security/… → security headers, /tls/… → TLS expiry. Responses carry ETag, Cache-Control: public, s-maxage and stale-while-revalidate, plus an accessible <title> and <desc>.
classicFREE
flatFREE
pillFREE
gradientPRO
iconPRO
detailedPRO