Public methodology
This page is the single source of truth for the Accesseon Trust Score. Every change ships with a changelog entry and we never silently rescore customers. Every scan stores the algorithm version it was scored under so historical scores stay comparable to themselves.
TrustScore = sum over modules m in version V of
ModuleScore(m) * NormalizedWeight(m, V)
ModuleScore(m) = max(0, min(100,
100 - 25 * count(m.critical)
- 10 * count(m.high)
- 3 * count(m.medium)
- 0.5 * count(m.low)
))
NormalizedWeight(m, V) =
Weight(m, V) / sum over successful modules of Weight(n, V)Modules that failed or were not run drop out of the composite; the remaining weights renormalize so partial scans still produce a comparable score.
Full axe-core scan against WCAG 2.0, 2.1, 2.2 A + AA, Section 508 (US), EN-301-549 (EU), and W3C ACT. AAA rules are excluded by default because no major jurisdiction mandates them and they generate noise. Color-contrast and a handful of other rules are flagged as 'needs review' because automated tooling has known false positives there.
Supabase Row Level Security audit using the customer's own anon key. We probe the three tables most commonly misconfigured in vibe-coded apps (profiles, users, orders). Matches the CVE-2025-48757 pattern. Service-role keys are rejected at the settings layer - we only accept anon keys.
Navigation-timing metrics: Time to First Byte, First Contentful Paint, Largest Contentful Paint. Plus transfer size and resource count. Thresholds follow Google's 'good / needs improvement / poor' Core Web Vitals bands.
Heuristic checks for EU AI Act Article 50 disclosure (when a chatbot is detected), subprocessor disclosure (when third-party AI APIs are called from the client), GDPR DPA availability, and Product Liability Directive readiness (security.txt per RFC 9116, published SLA).
Authenticated IDOR probes, rate-limit checks, XSS reflection tests, session-cookie hygiene. Does not run until DNS-TXT ownership proof, ToS active-testing clauses, hard scheduling limits, and cyber/E&O insurance are all in place.
Four-dimension composite. Accessibility continues to use axe-core + WCAG 2.2 + EN-301-549 + Section 508. Security adds a customer-credential Supabase RLS audit. Performance measures Core Web Vitals + transfer size + request count. AI Compliance checks EU AI Act Article 50, subprocessor disclosure, GDPR DPA availability, and Product Liability Directive readiness (security.txt, published SLA).
Three-dimension composite. Preserved for historical score comparability.
Two-dimension launch version. Preserved for historical score comparability.
Adds the Runtime Behavior module (authenticated IDOR probes, rate-limit checks, session-cookie hygiene). Does not ship until DNS-TXT ownership proof, active-testing ToS clauses, hard rate limits, and cyber/E&O insurance are all in place.
Want to verify a specific site's score? Scan it now.