Every state the Sentinel badge can show — from a flawless A+ to the error fallbacks. Copy a snippet, drop it in your README, and let it update itself after every scan.
A+ to F — determined by the scoring methodology
No issues found. Perfect posture across all 7 categories — the badge every repo wants.
[](https://sbscanner.pro-sub.org/methodology)<img src="https://sbscanner.pro-sub.org/api/badge/minty.app" alt="Sentinel security score for minty.app" />Only a handful of low-severity issues. Strong headers, TLS, and email auth.
[](https://sbscanner.pro-sub.org/methodology)<img src="https://sbscanner.pro-sub.org/api/badge/stellar.dev" alt="Sentinel security score for stellar.dev" />A few medium findings. Missing HSTS or DMARC hold the score back.
[](https://sbscanner.pro-sub.org/methodology)<img src="https://sbscanner.pro-sub.org/api/badge/northwind.io" alt="Sentinel security score for northwind.io" />Mixed findings across several categories. Some headers are missing.
[](https://sbscanner.pro-sub.org/methodology)<img src="https://sbscanner.pro-sub.org/api/badge/midway.dev" alt="Sentinel security score for midway.dev" />Multiple high-severity issues. Take a remediation pass before launch.
[](https://sbscanner.pro-sub.org/methodology)<img src="https://sbscanner.pro-sub.org/api/badge/legacy.co" alt="Sentinel security score for legacy.co" />Critical findings force an automatic F — even with a decent point score.
[](https://sbscanner.pro-sub.org/methodology)<img src="https://sbscanner.pro-sub.org/api/badge/atrisk.net" alt="Sentinel security score for atrisk.net" />What a badge looks like before data exists — and when things go wrong
Last scan is older than 30 days. The original grade is kept but the badge turns amber until you re-scan.
[](https://sbscanner.pro-sub.org/methodology)<img src="https://sbscanner.pro-sub.org/api/badge/forgotten.dev" alt="Sentinel security score for forgotten.dev" />No scan result stored for this domain yet — registered but never scanned, or scanned in a different environment. Shown until the first scan completes.
[](https://sbscanner.pro-sub.org/methodology)<img src="https://sbscanner.pro-sub.org/api/badge/freshsite.dev" alt="Sentinel security score for freshsite.dev" />Empty or malformed domain in the URL path.
[](https://sbscanner.pro-sub.org/methodology)<img src="https://sbscanner.pro-sub.org/api/badge/not%20a%20domain" alt="Sentinel security score for not a domain" />The stored scan result could not be parsed as JSON.
[](https://sbscanner.pro-sub.org/methodology)<img src="https://sbscanner.pro-sub.org/api/badge/corrupt.dev" alt="Sentinel security score for corrupt.dev" />The badge service hit an internal error. Retry shortly.
[](https://sbscanner.pro-sub.org/methodology)<img src="https://sbscanner.pro-sub.org/api/badge/outage.dev" alt="Sentinel security score for outage.dev" />The endpoint reads your latest stored scan result for the domain. No scan yet → No scans. Invalid domain → Invalid domain. Everything healthy → A+. Critical findings force an F regardless of the point score. A scan older than 30 days turns the badge amber with a Stale label until you re-scan.
Raw JSON for img.shields.io endpoint badges and GitHub profile READMEs
/api/badge/status/:domain returns a shields.io-compatible JSON payload (B (82), hex color, staleness). Point an img.shields.io/endpoint badge at it, or load it directly in a browser with a callback for JSONP. Supports ?label=, ?showAge=1, and ?callback=fn.
[](https://sbscanner.pro-sub.org/methodology)<script src="https://sbscanner.pro-sub.org/api/badge/status/example.com?callback=renderBadge"></script>
<script>
function renderBadge(data) {
console.log(data.grade, data.score, data.stale);
}
</script>One line in your README.md — the badge fetches the latest grade automatically, no regeneration needed.
[](https://sbscanner.pro-sub.org/methodology)<img src="https://sbscanner.pro-sub.org/api/badge/minty.app" alt="Sentinel security score for minty.app" />Scan your domain, grab your badge, and let it speak for your security posture in your README, docs, or site footer.