FREE TOOL

AI Security Score Badge for GitHub Repos

One line in your README shows the world your repo's security grade — A through F, from a real static-analysis scan. Secrets, injection flaws, XSS, CI/CD pipeline risks. Free, no signup.

Live examples

Real badges on real open-source repos, scanned October 2026:

ghostaction-guard-action

Score 100/100 · Grade A — clean · GitHub Action that blocks malicious CI workflow injection

vibecode-scanner

Score 90/100 · Grade A — clean · AI-codereview static scanner

domainguard-impersonation-spotcheck

Score 90/100 · Grade A — clean · Domain impersonation spot-check tool

cve-digest

Score 100/100 · Grade A — clean · Daily CVE digest generator

prompt-injection-evals

Score 100/100 · Grade A — clean · Prompt-injection evaluation suite

cve-to-checker

Score 100/100 · Grade A — clean · CVE-to-checker page generator

cve-2026-110447-checker

Score 100/100 · Grade A — clean · Nextcloud CVE-2026-110447 exposure checker

ai-disclosure-checker

Score 100/100 · Grade A — clean · AI disclosure compliance checker

homelab-security-score

Score 100/100 · Grade A — clean · Homelab security scoring quiz

Add the badge to your README

Copy this into the top of your README (Markdown):

[![AI Security Score](https://ingeniousai-security-checks.netlify.app/badges/YOUR-REPO.svg)](https://ingeniousai-security-checks.netlify.app/ai-security-badge.html)

The badge image links here, where visitors see what the grade means and how it was earned.

Get your repo scored

Run a free scan of any public repo, then claim your badge:

Scan my repo free More free security checks

How the grade works

What does the scanner check?

Hardcoded secrets and API keys, SQL injection patterns, XSS sinks, dangerous functions (eval, exec, shell calls), insecure deserialization, and CI/CD pipeline risks — including malicious workflow injection in the style of the October 2026 GhostAction supply-chain campaign.

How is the score calculated?

Every repo starts at 100. Critical findings subtract 25, high 10, medium 4, low 1. 90+ is an A, 75+ a B, 50+ a C, 25+ a D, below that an F. Test fixtures, docs, and example files are excluded — only shipped code counts.

Is it really free?

Yes. The badge, the scan behind it, and the report page are all free with no signup. It's built by Ingenious AI, the team behind Vibe-Code Audit.

Can the badge improve my project's trust?

That's the point. A visible, independently-computed security grade answers the first question every evaluator asks: "is this safe to depend on?" Link it next to your build-status badge.

Methodology: static analysis of shipped production code (October 2026 scan). Grades reflect the code as scanned; rescan after significant changes. A badge is a signal, not a certification.