// shipping in the open

Changelog

What we shipped, and when. We build this in public because a security tool nobody maintains is worse than no tool at all, and the honest way to prove maintenance is to show the work.

  1. new auditemailBIMI

    Audit 2: BIMI readiness

    A second, independent ranking. We now check whether your logo can appear in the inbox, and tell you the exact reason when it cannot.

    ApeCyber now runs two audits, and they answer different questions. Your posture score says how exposed your site is. Your new BIMIBIMIEmail authBrand Indicators for Message Identification: a DNS record that tells email apps to show your logo beside your messages in the inbox. It only takes effect once DMARC is set to quarantine or reject, so the logo doubles as visible proof your email security is switched on. tier says whether your logo will render next to your email, and how far you are from that.

    The two never merge into one number. They have different owners, different fixes, and different urgency, so you get a row of scores rather than an average that hides both.

    BIMI is worth checking because it never reports an error. When a gate fails, the logo simply does not appear, and nothing anywhere tells you why. Two of those gates are effectively invisible: pct=90 on your DMARCDMARCEmail authDomain-based Message Authentication: a DNS policy telling receivers what to do with mail that fails SPF or DKIM, and which emails you a report of everyone spoofing you. record passes every checker on the internet and still blocks the logo permanently, and sp=nonesp=DMARC policyThe DMARC setting that covers your subdomains, such as mail.yourdomain.com. Leaving it looser than your main policy lets people spoof a subdomain and blocks BIMI outright, even when the main domain is at the strictest setting. disqualifies you even when your main policy is set to reject.

    Most domains we look at sit at BIMI T1, which means they already qualify and have simply never claimed the slot. That is one DNSDNSInfrastructureThe Domain Name System, the internet's address book. It's also where you publish the SPF, DKIM, DMARC and CAA records that secure your domain. record away from a logo.

    Every gate is checkable from outside with one dig and two curls, so the check is free and needs nothing from you. The full ladder and the exact fix for each rung are in the BIMI readiness checklist.

  2. portalcharts

    Compare one domain against the whole field

    Chart any single domain against every site we have scored, and drop domains you no longer want to track.

    If you track more than one domain, the charts used to show all of them at once. Now you can pull a single domain out and see it on its own against the whole field, which makes it obvious whether a site is genuinely behind or just quieter than the rest of your portfolio.

    You can also stop tracking a domain you no longer care about, without losing the history on the others.

    Printed reports got a pass too. They now match the site wordmark, print correctly the first time instead of needing a second attempt, and article pages sit centred on the page.

  3. field manualQRportal

    The whole checklist, and a QR code per fix

    Every scanner check now has a written fix page, and printed reports carry a QR code that opens the exact fix for that finding.

    Every check the scanner can report now has a fix page behind it. No finding tells you something is wrong and then leaves you to search for the answer.

    Printed reports carry a QR code per finding, and each one opens the page for that specific fix rather than a generic index. Scan the code on a report about your DMARCDMARCEmail authDomain-based Message Authentication: a DNS policy telling receivers what to do with mail that fails SPF or DKIM, and which emails you a report of everyone spoofing you. record and you land on the DMARC fix, not a table of contents.

    The checklist itself is now grouped by category with live search and filters, so you can jump straight to headers, or cookies, or email, instead of scrolling.

    Reports also greet you as the domain the report is about, which matters when you manage several.

  4. portalbadgeschampions

    Portfolios, badges and the Champion challenge

    Track as many domains as you like, show off your score with an embeddable badge, and race our record for shipping a change.

    The scanner became a portfolio. Add as many domains as you want, each scored and tracked on its own, and see where every one of them lands against the whole field in two charts.

    There is no ownership check, because there is nothing to own. Anyone can point a browser at any site, us included, so tracking a domain simply means you want to watch it.

    If you like your score, there is now an embeddable badge in three styles you can put on your own site. It carries a verification token, which is also how the Champion challenge works: embed the badge, and we time how long it takes you to get the change live. Pass that and the DNSDNSInfrastructureThe Domain Name System, the internet's address book. It's also where you publish the SPF, DKIM, DMARC and CAA records that secure your domain. round starts, with a countdown that gets shorter every time you win.

    We hold the record. You are welcome to take it.