Scoring Methodology

How we calculate the AI Launch Score

The AI Launch Score is a 0-100 numeric metric designed to measure the security launch-readiness of an AI-built website. Because AI-generated applications ship fast, they require clear, transparent security guardrails before receiving production users or paid traffic.

The 5 Dimensions of Launch Readiness

Our scanner evaluates your site across five distinct dimensions, each weighted according to its potential impact on production safety.

1. Scanner Findings

40% Weight

Core vulnerabilities detected by our ZAP, Nuclei, and Semgrep scanners (e.g. injection, open redirects, fuzzer exposures).

2. AI-App-Specific Risks

25% Weight

Risks common to AI-built stacks, such as exposed source maps, hardcoded secrets, weak cookies, and public admin routes.

3. Browser Posture

15% Weight

Security response headers that harden browser behavior (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy).

4. Domain Verification

10% Weight

Verification of domain ownership via DNS TXT. Verified domains prove the owner is scanning their own infrastructure.

5. Retesting History

10% Weight

Retesting credit awarded when open findings are re-evaluated to prove the development team is actively shipping fixes.

Point Deductions & Limits

Calculations start at a base score of 100. When vulnerabilities or misconfigurations are detected, points are deducted based on finding severity:

  • -15 pts Critical severity finding
  • -8 pts High severity finding
  • -3 pts Medium severity finding
  • -1 pt Low severity finding

Scoring Guardrails

To prevent a single heavily reported issue category from reducing the score to zero, deductions are capped at the maximum weight of their respective dimension. For example, browser header issues will never decrease the total score by more than 15 points.

Scoring Credits:

  • Retesting Credit: Re-add +5 points if the site has been successfully re-scanned within 30 days.
  • DNS Verification Credit: Re-add +5 points if the domain has completed DNS TXT verification.

Scoring Bands

85 - 100
Launch Ready

The application has a hardened posture with no critical or high severity blockers.

70 - 84
Mostly Ready

Only minor issues exist. Safe for limited preview and internal reviews.

50 - 69
Risky Launch

Active launch blockers identified. Unsafe for public users or billing.

0 - 49
Not Production Safe

Severe structural risks. Requires immediate mitigation.

Ready to measure your launch readiness?

Verify your domain origin, run a full security assessment scan, and get your AI Launch Score in under 10 minutes.

Get your AI Launch Score