security
Trust Badge
A Public Badge That Stops Saying Verified When It Stops Being True.
What you get
Verified Means Recent And Clean
The badge reads verified only while the latest scan is under 30 days old with no open critical or high findings. A risk you accepted still counts against it.
It Lapses On Its Own
A re-scan that finds a serious problem turns it off, and so does time: once the latest scan is too old, the badge says not verified until a new scan completes.
Shows The Outcome, Never The Details
Visitors see verified or not verified and the date of the last scan. Finding counts and reasons stay with you, so the badge never advertises a weakness.
Kept Current On Every Paid Plan
On a paid plan the badge's code is re-scanned at least once a month, before the badge would lapse: nightly from LoomWorks, and by a monthly re-scan on the plans below it. Those re-scans never count against your scan allowance, and if one cannot run, the reminder email still goes out.
A Reminder Before It Lapses
Owners and Admins get one email per scan cycle in the week before the badge would lapse, so it can be renewed with a fresh scan.
How It Works
- 1
An Owner or Admin switches the badge on from the project page. It is off until then.
- 2
Copy the Markdown or HTML snippet into your README or site. The image links to a verification page on ziploom.dev.
- 3
Every completed scan of your code re-decides the badge. Nobody can set it by hand.
- 4
On a paid plan, a re-scan starts on its own before the latest scan ages out, without using your scan allowance. On the free plan it does not.
- 5
In the week before the latest scan ages out, Owners and Admins get one reminder email to run a fresh scan.
What this check inspects
The latest completed scan of the project's code: whether it finished and how old it is. Live-site re-checks and deploy-time checks do not count toward it.
Open critical- and high-severity findings from that scan. Only ones marked fixed or a false alarm stop counting.
What it means when this fails
A badge that only ever says yes is decoration. If the latest scan is too old or found something serious, the badge says not verified, and the verification page says why in general terms without listing what was found.
Questions
- Does the badge show my findings?
- No. It shows verified or not verified and the last scan date. The details are visible only to members of your workspace.
- Why did my badge stop saying verified?
- Either the latest scan found an open critical or high issue, or it is more than 30 days old. Run a fresh scan from the project page.
- Does it re-scan for me?
- On a paid plan, yes. From LoomWorks your code is scanned nightly; on the paid plans below it, the badge's code is re-scanned at least once a month, before the badge would lapse. Neither counts against your scan allowance. On the free plan nothing re-scans for you: the badge lapses after 30 days unless you run a scan, and the reminder email does not start one.
Related features
Security Scan On Every Deploy
Catch RLS Gaps, Secret Leaks, And CVEs Before Your App Is Reachable.
Learn moreSecrets Detection On Every Push
Every File, Every Push — API Keys And Tokens Your AI Tool Left In The Code.
Learn moreLaunch Readiness + Free Security Tools
Four Free Checks For Any Site. A Grade Only The Owner Can Publish.
Learn more