News
How to Read an OPSEC Score (1–10) on a Public URL
February 23, 2024
How to read an OPSEC score (1–10) on a public URL: start at the top of the scale and subtract for evidence-backed misses on that response — headers, TLS, cookies, exposed paths, client-side secrets, and the rest of the catalog that actually fired. A 10 means the scanner did not land those deductions, not that the company is unhackable. A 4 means the public costume is leaking. RoastMyOpsec publishes free-audit scores on a leaderboard when you allow it. The number is a roast, not a compliance certificate.
The practical difference
A score is a summary of what this scan could prove from public HTTP, DNS, and optional GitHub. It is not PCI, SOC 2, or a red-team report. Passing findings do not add bonus points; they avoid penalties.
Teasers and inconclusive checks (for example a session cookie issued only after login) should not be treated as a silent 10 on that control.
How to choose what to fix from the number
Read the unlocked findings first. Critical and high evidence-backed items move the score more than info. Fix exposed secrets and VCS paths before arguing about Server banners. Re-scan the URL you own after the edge config changes.
| Band | Usual story | First move | Takeaway |
|---|---|---|---|
| High 8–10 | Public surface is mostly adult | Still open the vault; banners and trackers hide there | Not a pentest pass |
| Mid 5–7 | Several real misses | Headers, cookies, mixed content, robots | Punch list, not panic |
| Low 1–4 | Secrets, VCS, or cleartext-class problems | Rotate, deny paths, force HTTPS | Treat as an incident rehearsal |
| No score / unreachable | Scanner could not gather evidence | Confirm the URL is public and owned | Not an OPSEC F |
Leaderboard vs private report
The weekly board is highest scores among published free audits. Shame is a feature. If you do not want a hostname listed, do not publish that scan. The report URL is still the place to work the findings.
Website vs app mode can change which catalog items apply. Do not compare an app origin to a brochure site as if they were the same exam.
Common mistakes
The first mistake is screenshotting 9.4 and skipping the blurred vault.
The second mistake is comparing scores across different dates without re-running the same URL.
The third mistake is treating a demo or staging host as production OPSEC.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is a 10/10 OPSEC score a security guarantee?
- No. It means this public-surface roast did not deduct for the evidence it could see. Authenticated bugs, business logic, and private networks are out of scope.
- Why did my score change after I only fixed CSP?
- Each evidence-backed miss has a different weight. One header can move the needle; an exposed .env moves it more. Re-scan to see the new total.
- Does the leaderboard include vault-only findings?
- Published free audits use the free-scan score. Unlocking the vault is for the full roast copy, not for bragging rights on a different exam.