Transparent methodology
How the VibeFootprint website scan works
VibeFootprint turns publicly delivered website signals into two separate assessments: a qualitative pattern-similarity index and a public security-header baseline. The method is intentionally bounded so the result remains useful without claiming to know who authored a website.
Scan a website for free→1. What the scanner collects
The scan begins with the public HTML document and its response headers. It may then inspect a bounded selection of same-origin scripts, stylesheets and manifest information over validated, peer-pinned connections.
No login, repository connection or private source code is requested. The target website can still record the scanner’s ordinary public requests in its server logs.
- Public HTML and document metadata
- Selected response headers
- A limited set of same-origin assets
- Public structural and stack signals
2. How the Vibe-Footprint is produced
The frozen reference model combines public technical and structural features into a value from 0 to 100. A higher value means that more of the observed surface resembles patterns in the reference corpus; a lower value means less observed similarity.
The score is an uncalibrated qualitative index. Individual score drivers describe relative model influence rather than additive points, and evidence breadth is reported separately instead of silently changing the score.
3. Why security is a separate score
The security baseline evaluates selected values in public main-document headers. A strong security score does not lower the Vibe-Footprint, and a high Vibe-Footprint does not reduce the security score.
Keeping both assessments independent prevents design similarity from being presented as a vulnerability and prevents strong headers from being presented as evidence of originality.
- Content Security Policy
- Strict Transport Security
- Frame and content-type protection
- Referrer and permissions policies
4. Interpretation and limitations
The public-surface scan does not execute a complete browser, test application behavior or inspect backend systems. It cannot replace repository review, penetration testing, accessibility testing or product QA.
Results should be used as a prioritized review aid: inspect the cited evidence, decide which changes fit the product, implement them safely and compare a fresh scan after deployment.
Common questions
Can VibeFootprint prove that a website was made with AI?+
No. It measures similarity between observed public website patterns and a reference corpus. It does not establish authorship, causality or generated-code share.
Does the scanner need source-code access?+
No. The standard scan uses the public website surface and a bounded selection of same-origin resources.
Is the security baseline a penetration test?+
No. It is a focused review of selected publicly visible response-header protections.