Public LLM-security badge
Drop a live security grade into any README, docs site, or marketing page. The badge endpoint serves a Shields-style SVG (grade A through F or N/A) from a conclusive run, cached at the edge for 5 minutes. Sandbox-only by design — embedding a badge for a real customer endpoint would leak the customer's posture.
The public badge turns a conclusive sandbox run into a Shields-style SVG grade — A through F, or N/A when evidence is not conclusive — that you can drop into a README, a docs site, or a marketing page.
Embedding is one image URL plus a link. The endpoint caches at the edge for five minutes, and the run page renders the copy-paste snippets with your run id already filled in.
Key points
- Letter grade comes from a tight rubric: A (overall_risk ≤10), B (≤25), C (≤40), D (≤60), F (>60). N/A is used for missing, partial, inconclusive, or legacy-unverified evidence.
- SVG width is computed from the letter so it never reflows when the grade changes.
- Endpoint: GET /v1/badges/runs/{run_id}.svg — same auth allowlist as the demo permalinks (no API key needed).
- JSON variant at /v1/badges/runs/{run_id}.json exposes {assessment_status, evidence_coverage_pct, letter, color, score, tested_at} for bespoke widgets.
How to embed
- Markdown: [](https://doesitdefend.ai/demo/runs/run_xxx)
- HTML: <a href="https://doesitdefend.ai/demo/runs/run_xxx"><img src="https://api.doesitdefend.ai/v1/badges/runs/run_xxx.svg" alt="LLM security badge"></a>
- The /demo/runs/{id} page renders a copy-paste block with the snippets already filled in.
The Markdown and HTML snippets point at the badge endpoint and link back to the public run page, so a reader can click through to the evidence instead of trusting a static claim. The SVG is served for a specific run id — there is no account-level grade to embed.
Why sandbox-only
- A badge for a paying customer endpoint would advertise that customer's posture publicly — a leak surface they didn't opt into.
- Sandbox runs (Juice Shop + VulnBot today) carry no PII and use our own attack-target infrastructure, so a public badge is safe by construction.
- If you want a 'compliance status' badge for your own team, build it against your private dashboard.
Badges are sandbox-only by design: a paying customer's endpoint would have its posture advertised publicly without consent. Sandbox runs use our own attack-target infrastructure and carry no customer data. For internal grades, build against your private dashboard instead.
Related resources