Is this badge real?

Every vibecheck badge links to its report. The report is the claim; the image is just a pointer to it. This page opens the report and checks its signature.

Open this page from a badge, or paste a report link here.

How a report is checked

When psychosecurity.io runs a scan, it signs the result with an Ed25519 key that never leaves the server. The signature covers every finding, the score, the address or commit that was scanned and when. Change one character and it no longer matches. Your browser checks it against our public key, published at /.well-known/vibecheck-key, and the report says verified or tampered. Nothing is stored: the signed report travels inside the link.

What the badge levels mean

Level	Needs
Gold	total of 85 or more, and no critical or high findings open
Silver	total of 70 or more, and no critical findings open
Bronze	total of 50 or more, and no critical findings open
None	anything else. The report still shows what to fix.

A vibechecked badge means every check that applies to the site passed at bronze or above, all signed by us, for the same site, within 30 days.

What a badge pins down

When. Every badge shows its scan date and turns grey 30 days later: "expired · rescan". Badges can't be withdrawn early, because nothing is stored to withdraw. They expire instead.
What. A site check records the address the site ended up at after redirects. A code check records the commit, and the badge says "commit abc1234".
Who ran it. Only scans run on psychosecurity.io are signed. A badge from the command-line tool says "self-reported"; one from a GitHub Actions run says "CI run" and its report links to the run, so you can open its log.