Docs

Badges

Show the world your site passes a Vergate security audit.

A Vergate Verified badgeis a JWT-signed trust badge you can embed on your site to prove it passed a security audit. It's issued per project and can be revoked at any time.

#Requirements

To issue a badge, your project's latest security scan must have zero critical findings. The badge is issued for a specific domain detected from your project URL.

#Issuing a Badge

  • 1

    Run a scan

    Make sure you've run a passive security scan on the project.
  • 2

    Open the Badges page

    In your project, click Badges in the sidebar.
  • 3

    Issue

    Click Issue Badge. If your latest scan is clean, a badge JWT is generated with a 6-month expiry.

    • #Embedding on Your Site

    From the Badges page, copy the HTML embed snippet and paste it anywhere on your site. The badge widget renders a small verified shield that links back to Vergate:

    Badge embed
    <script src="https://api.vergate.dev/static/badge.js" data-badge="PASTE_YOUR_TOKEN_HERE" defer></script>

    #How Verification Works

    Anyone can verify a badge by visiting https://api.vergate.dev/static/badge_verify.html with the token, or via the verify_badge MCP tool. Verification checks:

    Signature — Is the JWT signed by Vergate's badge key?
    Expiry — Is the badge within its 6-month validity window?
    Revocation — Has the badge been revoked?
    Domain binding — If the badge was issued for a domain, does it match?

    Verification never exposes vulnerability details — it only shows safe analytics like scores and technology stack.

    #Revoking a Badge

    Click Revokeon the Badges page. Revoked badges immediately fail verification everywhere they're embedded. You can issue a new badge after fixing the underlying issues and re-scanning.

    Tip. Badges are re-issued after a clean re-scan. Vergate enforces a 1-hour cooldown between re-scan attempts per project.