The Problem with Software Scores
A vendor puts "SOC 2 Certified" on their website. You trust it. But did you verify the certificate? Did you check if it expired? Did you confirm the scope covers what you're actually buying? In most procurement cycles, the answer is no. The badge is a JPEG. The trust is assumed.
Static analysis tools generate scores. Penetration test reports assign ratings. Compliance audits produce letters. All of them share the same fundamental weakness: the score is a claim, not a proof. The vendor tells you what they scored. You believe them or you don't.
HICS changes this. Every score is cryptographically attested with post-quantum algorithms that cannot be forged, altered, or faked — not by the vendor, not by H33, not by a future quantum computer.
The Attestation Chain
When a vendor runs HICS, four cryptographic operations produce an unforgeable certificate:
The result is a .h33 certificate file. The vendor keeps it. The buyer verifies it.
The code never leaves the vendor's machine. The proof speaks for itself.
The Verification Badge
Vendors who earn a HICS attestation can embed a verification badge on their website. This is not a static image. It's a live cryptographic check.
When a buyer clicks the badge, the verification endpoint checks five things in real time:
1. Does the Proof ID exist? If a vendor copies a badge image without a valid attestation, the check fails immediately. "UNVERIFIED — No valid attestation found."
2. Does the STARK proof verify? Mathematical verification that the scoring algorithm ran correctly. Cannot be forged without solving a hash preimage problem.
3. Does the Dilithium signature validate? Confirms H33 signed this specific certificate. The vendor cannot self-sign. A quantum computer cannot forge the signature.
4. Does the Merkle root match? The committed codebase fingerprint must be consistent. If the vendor changed their code after scanning, the root won't match a re-scan.
5. Is the certificate current? Attestations expire after 90 days. A stale badge shows its age. Buyers see exactly when the last scan ran.
If all five checks pass: green shield, verified score, full chain of trust. If any check fails: red badge, specific failure reason, no ambiguity.
Why Post-Quantum Matters Here
An ECDSA or RSA signature on a software score has a shelf life. When cryptographically relevant quantum computers arrive — estimates range from 10 to 30 years — every classical signature becomes forgeable. An attacker could retroactively create fake attestation certificates for any vendor.
Dilithium ML-DSA-65 (NIST FIPS 204) is lattice-based. Shor's algorithm doesn't apply to lattice problems. A HICS attestation signed today will still be unforgeable in 2056. The STARK proof uses SHA3-256 — hash-based, no algebraic structure to exploit. Both layers survive the quantum transition.
This isn't theoretical future-proofing. It's a practical statement: an attestation should outlast the software it attests. If your compliance certificate can be forged before your contract expires, the certificate is worthless.
What a Badge Proves
A HICS verification badge on a vendor's website is a statement of five facts, each independently verifiable:
This codebase was scanned. The Merkle root commits the exact files.
The scan ran this algorithm. The STARK proof attests correct execution.
The score was not altered. The Dilithium signature seals the result.
The attestation is current. The timestamp is part of the signed payload.
The code was never seen by anyone. Zero-knowledge. The proof reveals the score and nothing else. No source code. No architecture details. No proprietary logic. Complete transparency about quality without any transparency about implementation.
H33 is the first company to carry a HICS verification badge. Our score is 100/100 (Grade A), STARK-proven and Dilithium-signed. The full journey from 70 to 100 is documented in "From a C to 100." We published the C. We published the 100. We'll publish every score in between for every re-scan.
Embed It
Vendors who run HICS and purchase attestation receive an embeddable badge — a single script tag that renders the live verification widget. Three sizes:
Full badge — logo, score, grade, attestation chain, shield icon. For homepage footers, security pages, and procurement portals.
Compact badge — logo, score, shield. For headers, sidebars, and documentation sites.
Inline badge — text-only with shield. For README files, proposals, and contract appendices.
Every badge links to the public verification page. Every click runs the full cryptographic check. No trust required. The math does the work.
HICS scoring is free. Run it on any codebase, unlimited, no account required. The attestation — the STARK proof, the Dilithium signature, the verifiable badge — is what costs money. The score is a claim. The proof is a fact. That's the product.
Get started or read the HICS formula.