Methodology
How the index works
The rules that decide what appears on /readable, published so anyone can check them.
Disclosures
ARS measures format and retrievability. It does not measure whether the facts are true, or whether any assistant cites this page.
Verification
How a domain gets named
A named entry in the index requires verified domain-owner opt-in, and there is no other route into the index. The one surface outside it is our own comparison pages, where any printed scan carries its date, its ruleset and a link to rerun it.
DNS TXT record
Publish a TXT record containing rebilder-verify=<token> on the registrable domain. We resolve it, and the entry becomes eligible for named publication only after that resolution succeeds.
DNS is the method because it proves control of the domain rather than control of one page. A meta tag on a single URL is satisfiable by anyone who can publish one file to a subpath.
Or: the gateway, observed live
If we observe an X-Rebilder-Path response header served from the origin itself, that is equivalent proof for the same reason: it requires control of the response, not of a document.
Neither method involves an account, a plan, or a payment. Verification is about who controls the domain and nothing else.
What is eligible to be published at all
Only scans taken from a third-party vantage, meaning the public scanner and the index crawler. Nothing derived from an authenticated, merchant-sourced, or locally-run scan is ever published, whatever its score.
That means a merchant previewing an unlaunched page in Console, a developer running the CLI against staging, and an MCP scan on somebody's laptop are all structurally ineligible. It is a constraint in the schema, not a convention in the code.
Removal
How a domain gets out
Removal is free, self-serve, permanent, and never purchasable.
Free, self-serve, permanent, never purchasable
Removing an entry costs nothing and requires no conversation with us. It also cannot be bought, because a paid removal would turn the index into a pressure tactic.
We do market to businesses about their own scan results, including by email. Removal and unsubscribe are separate controls and neither is a lever on the other: unsubscribing never affects an index entry, and removing an entry is free whether or not you ever hear from us.
Unverified requests fail toward suppression
If a removal request cannot be verified, we suppress the entry anyway while we review it. Someone asking to remove a domain that carries their own name should not have to prove DNS control first. Wrongly suppressing an entry costs far less than wrongly keeping one.
Suppression is keyed by registrable domain and is consulted on the read path, the write path, and the badge endpoint. So a later crawl cannot quietly re-list a suppressed domain, and a stale badge cannot outlive the suppression.
Appeal outcomes are not published
If an owner disputes an entry and the entry stands, we publish nothing about the dispute: no log, no "reviewed and upheld" marker, no count.
Publishing that someone disputed an entry and lost would hurt them more than the entry itself. So we publish nothing about disputes.
Aggregates
What the aggregates publish
The floor is 25 and it is not a tunable
No aggregate is published about a group unless the bucket contains at least 25 independent domains. The floor is fixed; it is not a setting.
Buckets under the floor are not merged or coarsened to clear it. They are withheld, and the page says how many were withheld.
One domain, one row
Distributions are computed over the latest scan per domain per page kind, so a heavily rescanned site cannot weight its own bucket. Suppressed domains are excluded from the aggregates as well as from the named list. A suppressed entry is removed everywhere, not just hidden from the list.
Shares are published; underlying counts per grade are not, beyond the bucket size itself.
Versions
Rescoring and comparability
A MINOR bump re-probes the opted-in set
ARS scores are comparable only within an identical spec version and ruleset hash, which is why both are printed on every row. We do not retain third-party response bodies, so a stored result cannot be rescored under a new ruleset from the stored numbers alone.
When a MINOR lands we re-probe the opted-in set and publish new scores under the new ruleset hash. The opted-in set is bounded and consenting, so this is cheap and it keeps the time series comparable.
What the number is made of
ARS 0.2.0 allocates 63 of 100 points to measured checks and 37 to heuristic ones. A measured check reports a property of the bytes and headers we received; a heuristic check reports an inference about them.
Every check declares its basis in every result, and a heuristic value is never rendered without its label. The spec caps total heuristic weight at 40; a ruleset that exceeds it does not conform to the spec.