Signals planned: model card presence, training data disclosure, published red-team results. Some checks will be partially automated via website scanning; others require vendor submission.

Incident historypending

Signals planned: breach-history lookup, incident response quality assessment. This category is coming soon.

Security hygiene & transparency14/28 pts

Security headers

Content-Security-Policy header0/3

X-Frame-Options header0/2

X-Content-Type-Options: nosniff+2

Referrer-Policy header0/1

Source: response headers from qualys.com · Scanned 9/6/2026

security.txt

security.txt file found

Contact field present+2

Expires field present0/2

Encryption field present0/1

Trust page

Public trust/security page found0/5

HTTPS + HSTS

HTTP redirects to HTTPS+3

HSTS header enforced+2

Source: response headers from qualys.com · Scanned 9/6/2026

Disclosure policy

Security disclosure page found+3

Page references vulnerability reporting+2

Source: qualys.com/security · Scanned 9/6/2026

Rubric v1.3.0 · 14/28 implemented pts · click a category to see details

Current:Fair

With verification:Good(+6pts)

Claim this profile to improve your grade →

Add a PGP Encryption: field to /.well-known/security.txt to earn +1pt.

Score history (4 updates)

↑ improving

v1D+ → D+ → C → Cv4

Score history

Grade improved: D+ → C

9/6/2026

Scanned 3d ago

Certifications & disclosures

Found
security.txt
Discovered at qualys.com/.well-known/security.txt on 9/6/2026