Methodology

The 7-Frame benchmark

15,862 services in the catalogue as of 2026-09-28, of which 14,604 are measured on at least five frames — the bar for appearing in a ranking. Counts move daily as the catalogue grows.

Legit.Show grades how production-ready a launched service is by measuring seven frames from its public surface — the URL, HTTP response headers, and a Lighthouse run where it completes — so even closed-source SaaS is fully assessable. The score is deterministic and reproducible: there is no LLM in the scoring path, and every service is re-checked regularly. We show exactly what was observed; it is never a black-box “good/bad” verdict.

The seven frames

• Performance — Core Web Vitals and real load behavior, from a Lighthouse run where it completes
• Accessibility — Whether real users — including assistive tech — can actually use it
• Security — Security headers, HTTPS/transport, and exposure of the public surface
• Privacy — Cookies, consent banners, and third-party tracker / data leakage
• Reliability — Error handling, a real (not soft) 404, and monitoring signals
• Standards — Structured markup, canonical URLs, robots/sitemap, sane defaults
• Discoverability — Whether the page is built to be found and cited by AI answer engines

Form-aware scoring

Not every frame applies to every form. A static marketing site, a web app, an MCP server and an open-source repository are scored on the frames that make sense for each; frames that cannot be assessed are marked not-applicable rather than penalized. Open-source repositories additionally get a deeper code teardown.

What the score is not

The benchmark measures production-readiness hygiene observable from the outside — not whether the product is useful, well-designed, or worth buying. Those are human judgments; the benchmark is the objective, repeatable floor underneath them.

Reproducibility

Because scoring is deterministic and measured from public inputs, anyone can re-run the same checks and get the same result. That is what makes “according to Legit.Show” a citable measurement rather than an opinion.

Integrity rules

• Not assessed is not zero. A frame we could not measure is reported as not-assessed and left out of the average. It is never scored as a zero, because “we could not see it” and “it is bad” are different findings.
• An owner cannot change their score by asking. Verifying ownership unlocks history and deeper measurement. It never edits a number, and a re-measure runs the identical pass — it can come back lower.
• We never report an absence we did not observe. A page we were blocked from reading, timed out on, or could not reach is not evidence against the product.
• A substitute is not a measurement. Between 2026-06-10 and 2026-09-11, when a Lighthouse run failed, Performance was not left not-assessed. It was filled with a value derived from response time. The same failure left Accessibility not-assessed, and a not-assessed frame is left out of the average, so the total rose. Both effects pushed scores higher than the measurement supported. Those values were cleared on 2026-09-12 and none remain. When a Lighthouse run fails now, Performance is left not-assessed.
• Standards is measured two ways. When a Lighthouse run succeeds we use its result. When it does not, we count the standards themselves: the viewport tag, the favicon, the manifest, and the rest. This is the same frame measured a different way, not a different frame used in its place.
• The overall is a statistic, not a verdict. It is the simple mean of the frames we actually measured, with unmeasured frames out of the denominator — reproducible by anyone holding the frames.
• Scores are committed daily, somewhere we do not control. Every night the whole catalogue is hashed into a single fingerprint, and that fingerprint is committed to a public repository. Save the line for any date: if a score from that date is later changed, it no longer matches what was recorded. Leaf hashes are salted with a server-side secret, which keeps the published record from becoming a brute-forceable index of everything we measure — so this is a commitment, not a trustless proof, and we say so rather than implying otherwise. The record is at github.com/hans1329/notary, with a second copy at github.com/commitshow/notary committed separately by a different account, so one account being locked cannot silence it again. Both are current, and they should agree line for line — if they ever do not, believe neither. One window in it is weaker than the rest, and you should know which. The job that commits each night's fingerprint stopped between 2026-08-22 and 2026-09-10 while the account holding the previous copy was locked; those nineteen lines were therefore committed together on 2026-09-10 rather than each on its own day. The fingerprints themselves were computed nightly throughout and are unchanged — but a line committed in a catch-up proves less than a line committed the night it describes, so we are not going to present them as the same thing. Every line through 2026-08-21, and every line from 2026-09-11 on, carries the commit date it claims; check any of them with git log.
• The frames do not weigh the same in practice. Three of the seven — reliability, accessibility and standards — average around 90 across the catalogue, because they ask whether something works: valid SSL, reachable routes, a page that renders. Most shipped software passes. The separation comes from the other four: performance, discoverability, privacy and security. One consequence is that the total mostly uses the upper half of its range — the median is 78 and the 10th percentile is 62 — so a 72 here is nearer the bottom third than the middle. That is not a flaw in the frames: 695 listings score a perfect 100 on reliability while scoring under 70 overall, which is reliability correctly reporting that the thing is up. We have not rescaled anything to widen the spread; instead every score carries where it sits, so the number can be read without knowing any of this.

How we check our own numbers

We separate three things that are easy to conflate. Crawling is a bot taking our pages on a schedule; nobody asked. Retrieval is a bot opening a page because a person asked a question it needed to answer — OpenAI describes this as “triggered by user request”, and it uses a different, declared user agent. Citation is our page appearing as a source in the answer the person actually sees.

Between 2026-07-21 and 2026-08-19 we also sent the answer engines questions ourselves, every day, to see whether our pages were used. That creates a fair objection: if we asked roughly 89 questions a day and recorded roughly 61 retrievals a day, were the retrievals simply our own questions coming back? We tested it rather than assuming, on the thirty days to 2026-08-16.

• Across the twenty-four hours of the day, our probe volume and our retrieval count correlate at r = −0.070 — flat, and marginally negative. Our heaviest probe hour (1,524 questions) produced 24 retrievals; the heaviest retrieval hour (270) had 30 questions.
• Of 830 retrievals in those thirty days, zero were preceded by one of our own probes within five minutes — the only gap short enough to be cause and effect. Widening the window to two hours reaches 36%, which is what coincidence looks like when probes run in a few concentrated hours.
• What this rules out is our probes. It does not separate the case where a person happened to ask about a product we had recently measured, and we do not claim it does.

Our own probe results are a controlled test, not a survey: we choose the questions, so they can show that citation happens and cannot estimate how often it happens in the world.