Sample report: Evidence

What this is. Before paying for a check, it is reasonable to see exactly what you would get. This is not an invented example - it is the real report on our own site, published with the findings it produced.

1. What was observed

2. Findings

Five observations rise to findings. Each states what was observed, what it affects, and who can change it.

F1. The declared sitemap returns 404

https://cror.link/sitemap.xml responds 404 with an empty body. A search or AI crawler following the conventional path finds nothing, so page discovery falls back entirely to link-following. Owner: us. Effort: small.

Separately embarrassing: our own launch plan lists "submit /sitemap.xml to Search Console" as step one, and the file is not there. That is exactly the class of gap this check exists to catch - not a subtle strategy error, but a thing everyone assumes is done.

F2. The site is closed to most AI crawlers

Of ten declared tokens, seven are blocked: GPTBot, ClaudeBot, Google-Extended, CCBot, meta-externalagent, Applebot-Extended, Bytespider, Amazonbot. Allowed: OAI-SearchBot and PerplexityBot. Googlebot is allowed.

This is the default behaviour of the platform the site runs on, not a setting we chose - and that is the point of the finding. An access policy exists whether or not anyone decided it. For a company that works on machine readability, finding this on its own site is the clearest possible illustration of why the check is worth running.

Worth stating plainly: this is not necessarily a defect. Closing access to model training can be a deliberate decision. But a decision, not a default.

F3. Organization is declared with no sameAs

The entity exists in structured data and points nowhere. sameAs is how a declared entity is tied to the same entity elsewhere - company registry, professional profiles, directories. Without it the declaration is an island: machine-readable, but corroborated by nothing outside our own control. Owner: us. Effort: small, but genuinely blocked on something real - the corroborating profiles have to exist before they can be linked.

F4. og:image is absent

Three of four basic Open Graph properties are present. When the URL is shared into a chat, a messenger or a social post, there is no card image. Owner: us. Effort: small.

F5. None of the six observed security headers

Absent: strict-transport-security, content-security-policy, x-content-type-options, x-frame-options, referrer-policy, permissions-policy.

Presence is observed, not sufficiency: "CSP present" is an observation, "CSP is weak" is a judgement, and there is none here. Several of these headers are meaningful only for certain kinds of resource.

3. What this check cannot establish

Stated as plainly as the findings, because a check that hides its limits is not evidence.

• It observes one URL, not the whole site. Other pages may differ.
• It observes the public surface, not what AI systems actually answer about the organisation. Absence of a problem here is not proof of correct representation there.
• Robots policy is evaluated per token, and the token list is explicit and versioned. A token absent from the matrix was not checked - that is not the same as having no policy.
• It observes what is declared in robots.txt. Whether a given crawler honours that declaration is outside the observation.
• not applicable is a real outcome, distinct from pass. Where a check does not apply, we say so rather than crediting ourselves a point.
• It does not check whether the business claims on the page are true. That is different work with a different method.
• The text-to-document ratio is a number with no threshold. A meaningful cutoff would require a calibrated corpus and a sampling method; there is none, so there is no cutoff.

4. Why there is no overall score

Folding this into "73 out of 100" is technically easy and commercially tempting. We do not do it for one reason: a composite score hides what it is made of.

Different outcomes - "declared and working", "declared and not working", "not applicable", "could not be checked" - become indistinguishable once summed into a single number. Worse, the unchecked is usually counted as zero, so the score drops not because something was measured but because it was not.

Hence five named findings instead of one number. Each can be disputed on its own.

5. What happens in paid work

This sample stops at observation, which is where a free check should stop. Paid work continues:

1. Truth set - which public claims about the business must be correct: price, availability, certification, territory, contact, product specification.
2. Source map - where each claim is published today, and which of those sources you actually control.
3. Findings - where the surfaces disagree with each other or with the internal system of record.
4. Fix - corrections applied to sources you own; requests prepared for sources you do not.
5. Verification - publication confirmed, then a comparable recheck under the same conditions.
6. Change record - what was observed, what was changed, what was verified, what remains unverified, and the date the evidence should be rechecked.

Steps 1-6 are the offer. Step 0, the check above, is free and stays free.

Produced with Evidence, check contract version 0.15. Observations are reproducible: the same URL, the same token and the same date give the same result. A free access check for your own site is at evidence.bycror.com/tools/source-access-check.

Evidence by Bycror · evidence.bycror.com