The badge
“Checked by HackOrBroke” is a spot check, not a seal.
What it means
- The site owner ran a free HackOrBroke scan on the date shown on the badge.
- That scan reported no critical or high findings in what it fetched: the homepage, a few same-site scripts, a handful of well-known file paths, response headers, and (if they added one) the public GitHub repo.
- Medium and low items may still have been open. The badge is only offered when nothing serious showed up.
What it does not mean
- It is not a security certification, audit, or guarantee. Nobody at HackOrBroke reviewed the site.
- It is not a penetration test. The scan sends read-only GET requests: no logins, no password guesses, no database reads, and only a few routes.
- It describes one day. The site may have changed since the date on the badge.
- It is not verified per site. We don't store scans, so the badge isn't tied to a report, and anyone can paste it. Treat it as the owner's statement that they ran the check.
Check a site yourself
The scan is free and read-only. Run it on any site with the badge to see today's result, or on your own app before you launch.