Public score badges.

Live sample

Here is the badge for the open-source scanaislop/aislop CLI repo, served from badges.scanaislop.com:

live · cf-cache 5m / 4h browser

URL format

Two URL shapes. Both resolve to the same cached entry; the short alias is for prettier README markup.

# canonical
https://badges.scanaislop.com/score/<owner>/<repo>.svg

# short alias
https://badges.scanaislop.com/<owner>/<repo>.svg

Drop in your README

Use the linked form so the badge clicks through to your project page on scanaislop.com:

[![aislop](https://badges.scanaislop.com/score/<owner>/<repo>.svg)](https://scanaislop.com)

Setup

For a public repository, run an instant scan. The result page gives you a copy-ready badge immediately, with no account required.

Connected hosted repositories keep badge privacy opt-in. To enable one:

1. 01Sign in to app.scanaislop.com and connect the repository if you haven't already.
2. 02Run at least one hosted scan so the connected project has a score to display.
3. 03Toggle Public badge on the project's settings page, or call the API directly:

curl -X PATCH https://api.scanaislop.com/v1/orgs/<org-slug>/projects/<repo> \
  -H "authorization: Bearer $SCANAISLOP_TOKEN" \
  -H "content-type: application/json" \
  -d '{"publicBadgeEnabled": true}'

Owner or admin role is required for connected projects. The flag is org-scoped; flipping it does not change anything else about the project's privacy.

Score bands

Badge colour follows the latest scan's score:

Caching

Badges are static SVG, served from a Cloudflare Worker.

• 5 minutes at the Cloudflare edge (s-maxage).
• 4 hours in the browser cache (max-age).
• GitHub's camo proxy adds its own 4-hour to 7-day layer on top for repos rendered through github.com.

A new score lands on the next CI run for direct viewers, or within a few hours for visitors hitting GitHub-hosted READMEs. There is no manual purge yet; if you need one, ping support.

Privacy

Only the score and the project's <owner>/<repo> are exposed. No file paths, rule IDs, or diagnostics are reachable through the badge endpoint. The badge does not require auth on the viewer side; the opt-in flag is the only gate.