AI Launch Score (0–100)
Scoring Methodology
The AI Launch Score is an objective, mathematical security index designed to evaluate the launch-readiness of modern websites, SaaS applications, and AI tools. It synthesizes 200+ automated multi-engine checks across 6 weighted security dimensions into actionable readiness bands.
The 6 Dimensions of Launch Readiness
Unlike simple linting tools, Hack My Website evaluates both dynamic runtime attack surfaces and static code posture. Each dimension carries an explicit mathematical weight representing its exploitability in production.
1. Runtime DAST & Fuzzing
OWASP ZAP active crawler fuzzing HTTP endpoints, query parameters, auth cookies, and dynamic injection points for runtime vulnerabilities.
2. Known CVEs & Exploits
Nuclei v3.3 template engine matching 200+ known CVEs, exposed backup databases, misconfigured Next.js routes, and unauthenticated panels.
3. Code SAST & Leaked Secrets
Semgrep static analysis scanning source maps, frontend client bundles, and GitHub repositories for hardcoded API keys, tokens, and database URIs.
4. Security Headers & TLS
Browser posture validation covering HSTS preload, Content-Security-Policy (CSP), CORS wildcard rules, and secure cookie parameters.
5. DNS Ownership Proof
Cryptographic DNS TXT or well-known token verification proving legal asset control, preventing unauthorized scanning and spoofed targets.
6. Remediation & Patch Velocity
Continuous posture monitoring rewarding teams that resolve reported vulnerabilities and trigger verification re-scans within 30 days.
Severity Penalties & Mathematical Guardrails
Every scanned domain begins at a baseline of 100 points. Deductions are subtracted deterministically according to CVSS 3.1 severity scores, bounded by safety caps so non-critical noise never tanks an otherwise robust site to zero.
SQL Injection, Unauth RCE, Hardcoded DB Credentials
Stored XSS, Broken Object Auth (IDOR), Leaked Stripe Key
Missing CSP, Permissive CORS Wildcard, Open Redirect
Missing Referrer-Policy, Verbose Server Headers
To prevent duplicate warnings (e.g. 10 missing header variants) from masking actual code security, deductions within each vector are strictly capped at that vector's maximum assigned weight.
Score = clamp(0, 100 - Penalties + Bonuses, 100)Readiness Bands & Go/No-Go Decision Matrix
Scores translate into four clear readiness classifications used by engineering leads, investors, and security auditors to decide whether an application is safe for production traffic.
🟢 Launch Ready
Hardened production posture. Zero high or critical vulnerabilities. All security headers and DNS verification in place.
🟡 Action Recommended
Minor configuration advisories present. Safe for staging and closed beta, but requires fixing before public marketing push.
🟠 High Risk
High severity issues or secret leaks detected. Attackers could exploit these to extract customer data or hijack sessions.
🔴 Launch Blocker
Critical structural vulnerabilities or exposed administrative databases. Do not deploy to production under any circumstances.
Ready to Measure Your Website's Launch Readiness?
Verify your domain origin in 30 seconds and generate an objective 0–100 AI Launch Score with instant code fix prompts.