What is Shieldome Certification?
After each scan, Shieldome automatically evaluates your site's security posture and issues a certificate if the security grade is A or B. Certification is free — it comes with every completed scan that meets the threshold, at no additional token cost.
The grading system
Every completed scan produces a risk score from 0 to 100, calculated from the severity of findings:
| Finding severity | Points added to risk score |
|---|---|
| Critical | ×25 per finding |
| High | ×15 per finding |
| Medium | ×8 per finding |
| Low | ×3 per finding |
The score is then translated into a letter grade:
| Grade | Risk score | Certification |
|---|---|---|
| A | 0 – 9 | ✅ Certified |
| B | 10 – 29 | ✅ Certified |
| C | 30 – 49 | ✗ Not certified |
| D | 50 – 69 | ✗ Not certified |
| F | 70 – 100 | ✗ Not certified |
How to view your certificate
After a scan completes, a banner appears in the results panel:
- Green banner — "Certified by Shieldome" with a link to the public certificate page.
- Red banner — Shows your current grade and a link to the certificate page where you can see how to improve.
The certificate is also accessible directly at:
https://app.shieldome.com/certificate/<scan_id>
Embedding the badge
If your site is certified, a Shieldome badge is automatically generated. You can embed it in your website footer, README, or documentation to show visitors that your site has been independently verified.
HTML embed
<a href="https://app.shieldome.com/certificate/SCAN_ID" target="_blank" rel="noopener">
<img src="https://app.shieldome.com/certificate/SCAN_ID/badge.svg"
alt="Certified by Shieldome" height="40">
</a>
Markdown embed
[](https://app.shieldome.com/certificate/SCAN_ID)
Replace SCAN_ID with the scan ID shown on your certificate page. Both snippets are pre-filled on the certificate page itself — just copy and paste.
Certificate validity and renewal
A Shieldome certificate reflects the security posture at the time of the scan. There is no fixed expiry date, but a badge pointing to an old scan will show the grade from that scan. To keep your badge current:
- Re-scan regularly (monthly is recommended for production sites).
- Each new scan that achieves Grade A or B generates a fresh certificate URL.
- Update the badge URL on your site to point to the latest certificate.
- Use scheduled scans to automate recurring scans so your certificate stays fresh automatically.
Why certification matters
A Shieldome certificate is evidence that your site has been independently assessed against the OWASP Top 10 and scored below the risk threshold. This is useful in several situations:
- User trust — Displaying a verified security badge reduces friction for new users, especially for SaaS products handling sensitive data.
- Partner due diligence — Enterprise customers increasingly require security evidence before signing contracts. A public certificate URL is a simple, shareable proof point.
- Compliance posture — While not a formal compliance certification (e.g., SOC 2 or ISO 27001), a Shieldome certificate demonstrates security awareness and active monitoring, which contributes positively to compliance programs.
- Internal benchmarking — Track grade history over time to measure the impact of security investments and regressions after new deployments.
Frequently asked questions
Does certification cost extra?
No. Every completed scan evaluates certification automatically. If the grade qualifies, the certificate and badge are generated at no additional cost beyond the 1 token used for the scan itself.
Can I get certified with a single vulnerability?
It depends on severity. One medium finding adds 8 points (Grade A). One high finding adds 15 points (still Grade B, still certified). One critical finding adds 25 points (still Grade B, certified). Two critical findings add 50 points (Grade C, not certified). The threshold is designed to allow minor findings while blocking sites with serious unmitigated risks.
Is the certificate page public?
Yes — the certificate URL is designed to be shared. It does not reveal the full list of findings; it only shows the grade, score, and certification status. Search engine indexing is disabled (noindex), so the page is accessible but not searchable.
What if I disagree with a finding that is affecting my grade?
Use the false positive workflow in the app to mark findings you believe are incorrect. Marked findings are excluded from the risk score on your next scan.