Transparent by design

How the signal becomes a static posture score.

The model is deterministic, inspectable, and intentionally bounded. It compares observed public-origin signals; it does not rank entire companies or replace a DAST audit.

Analysis pipeline

BrowserURL input + report UI

Route handlerValidation + fetch/render

Analysis pipelineHeaders, cookies, rendered/static resources, DNS/TLS

ScoringWeighted evidence ledger

Local browserOptional summary history

Collection

What is inspected

Final HTTPS state and redirect behavior
Public HTTP response headers
Set-Cookie names and attributes, never values
Requested public page plus up to two same-origin HTML pages
Static script, iframe, image, link, form, and meta-refresh references across inspected pages
First-party versus third-party root domains
Matches against a transparent local provider pattern list
TLS certificate expiration and DNS posture signals
SPF, DMARC, MX, CAA, DNSSEC, MTA-STS, and TLS-RPT record checks
security.txt, robots.txt, sitemap.xml, mixed-content, form-action, SRI, reverse-tabnabbing, and inline-script risk checks

Boundaries

What is not inspected

No target JavaScript execution
No broad crawl beyond the capped same-origin HTML sample
No execution of referenced scripts, images, or iframes
No login, form submission, or session state
No exploitation or payload testing
No legal or regulatory compliance determination

Scoring ledger

TraceLattice calculates four component scores: security header posture, cookie hygiene, third-party exposure, and advanced posture. The final score is a weighted bounded snapshot, not a universal security verdict. Optional advanced headers such as COOP, CORP, and COEP are shown as evidence but are not treated like missing core controls for every site.

round(headers × 0.35 + cookies × 0.20 + exposure × 0.25 + advanced × 0.20)

Every component starts at 100. Deterministic deductions are applied only for observed findings, with per-category caps preventing one repeated signal from dominating the result.

Header posture35% weight

Cookie hygiene20% weight

Third-party exposure25% weight

Advanced posture20% weight

Core headersCSP, HSTS, frame protection, nosniff, referrer, permissions

Cookie contextsession/security cookies weighted above preference cookies

Exposure contextknown trackers and third-party scripts weighted above functional CDNs

Advanced contextTLS, DNS email-auth, DNSSEC, CAA, security.txt, SRI, forms, client-side risk

90-100score bandExcellent

80-89score bandGood

70-79score bandMixed signals

60-69score bandContext required

0-59score bandWeak

Interpretation matters

Every score carries limited confidence because TraceLattice does not execute JavaScript, broadly crawl, authenticate, or observe runtime network traffic. A lower score does not prove a breach, malicious behavior, or non-compliance. A higher score does not prove safety or compliance. This is an educational static snapshot that helps prioritize manual investigation.

Reproducibility

How to challenge a result

Export the JSON report, inspect each component reason and penalty, then compare the evidence with the target response. The score contains no hidden model call, random weighting, or proprietary external reputation feed. The same normalized inputs produce the same scoring decision.

Loading TraceLatticePreparing the requested view

What is inspected

Final HTTPS state and redirect behavior

Public HTTP response headers

Set-Cookie names and attributes, never values

Requested public page plus up to two same-origin HTML pages

Static script, iframe, image, link, form, and meta-refresh references across inspected pages

First-party versus third-party root domains

Matches against a transparent local provider pattern list

TLS certificate expiration and DNS posture signals

SPF, DMARC, MX, CAA, DNSSEC, MTA-STS, and TLS-RPT record checks

security.txt, robots.txt, sitemap.xml, mixed-content, form-action, SRI, reverse-tabnabbing, and inline-script risk checks