Publish your scan: shareable scorecard pages and embeddable badges by hostname

What changed

Until this week, the only way to share a scan was a permalink at `/r/<token>`, a frozen snapshot tied to a specific scan event. That works for "look at this result today," but it doesn't work for the use case more teams kept asking for: a stable, canonical URL for *the* scorecard of a hostname, that stays fresh as the site improves.

The new `/scan/<hostname>` page fills that gap. After running a scan from the homepage, signed-in users see a new "Publish this scan" toggle in the result panel. Flip it on and `scorifya.com/scan/yourdomain.com` becomes a live, indexable page showing the latest score, category breakdown, and a fresh-scan CTA. Every subsequent scan of that hostname updates what visitors see, no token churn, no manual refresh.

Custom social cards per scan

Share a published /scan/<hostname> URL on Slack, LinkedIn, X, or Linear and the link preview shows a custom card: a giant score ring with the actual number, the hostname, and the Scorifya brand mark. No more generic logo previews when you're sharing scorecards in conversations.

The card image is generated on demand from the latest scan, so it stays in sync with whatever the page currently shows. Verify it with LinkedIn Post Inspector or Facebook Sharing Debugger before posting if you want to see exactly what a reader will see.

Embeddable badge by hostname

Each published page also unlocks an SVG score badge at `scorifya.com/badge/<hostname>`. The /scan/<hostname> page renders a live preview of the badge plus a one-click Copy button for the HTML snippet, paste it into a README, marketing footer, or status page and the badge will always reflect the most recent score for that hostname.

Old token-scoped badges at /badge/<token> still work for the point-in-time share flow. The hostname route is the new path when you want a badge that lives alongside your brand, not alongside a single scan.

Opt-in, accountable, easy to unpublish

Public pages are off by default. The toggle is gated behind sign-in, anonymous visitors see a "Sign in to publish" prompt instead. When a user opts in, the account that flipped the switch is recorded internally as an accountability trail, so we know who published what if a question ever comes up.

Any signed-in user can unpublish a page in one click. We chose generous unpublish over strict unpublish on purpose: a stuck public page for someone who can't get back into the right account is worse than a malicious unpublish, which the original publisher can re-enable instantly.

Pages with no opt-in row return a friendly not-found state with no indexable content, so a hostname only goes live when someone actively decides it should.

How /scan/<hostname> compares to /r/<token>

**`/r/<token>`** is a snapshot: it captures one specific scan event, has an expiry tied to the publisher's plan (1 day anonymous, 5 days free, 30 days Pro, see tiered TTLs), and is meant for "here's what we saw at this moment" sharing. Two scans of the same hostname produce two different /r/ links.

**`/scan/<hostname>`** is a living page: one URL per hostname, no expiry, and the content refreshes every time a new scan is captured. It's meant to be the canonical scorecard you link to from a homepage footer, vendor questionnaire, or sales conversation.

Both exist because they answer different questions. Use /r/<token> for incident reports and time-stamped audits; use /scan/<hostname> for the stable badge-in-the-footer pattern.

How to publish

1. Sign in to your Scorifya account from the homepage.

2. Run a scan against the hostname you want to publish.

3. After the result loads, scroll to the "Publish this scan" panel and toggle it on. The public URL appears immediately.

4. To add a badge, scroll to the embeddable snippet and click Copy. Paste it into your README, marketing site, or wherever else you want the score visible.

5. To unpublish, return to the toggle and flip it off, or any signed-in user can unpublish from the page itself.

Scope reminder

Publishing a /scan/<hostname> page does not change scope, weights, or methodology, it's the same breadth-first 0–100 scorecard described on the methodology page. The public surface is a presentation layer, not a different scan. The number you see at /scan/yourdomain.com is the number you'd see running the same scan from the homepage anonymous.