How this lab stays independent

Major Labs is run by one person, Charlie Major, in his own time and at his own cost. There are no sponsors, no advertisers, no paid placements, no consulting clients and no investors. Nobody pays to be listed, scored, excluded or re-scanned. The about page sets out the background.

The operator is employed full time by a payments company. That employer has no role in this lab: it does not fund it, review it, see it before publication, supply data to it, or receive data from it. Nothing on this site describes that employer's products, plans or internal work, and the lab does not score or rank it. Where a sibling publication carries an author disclaimer, it is the full extent of the relationship.

Every published measure has a definition and a start date. Once published, the definition does not change. If a question has to change, it becomes a new measure with a new name and its own start date; the old one keeps running until it is retired with a date. A composite is published only over components that have shared a stable method for the whole period it covers. When that is not true the composite is withheld and the page says so, as the Trust Index does today.

Scoring weights, risk patterns and thresholds live in the public scanner repositories. A change to any of them is a dated commit and a line in the build log, never a silent edit. New measures enter through three stages, discovered, candidate and measured, and only the third stage reaches a scoreboard or a badge. The method note is in the scanner repository.

A degraded sweep. If more than five percent of fetches fail in a run, nothing from that run is published; the previous week's figures stand and the log records the failure. Per-server security findings. Those go to maintainers through coordinated disclosure, never to a public list. Per-merchant rows from the readiness index. Only aggregates are published. Any run record from the Hunch playground, which belongs to the person who started it.

A correction is made in place with a dated note that says what was wrong, not by deleting the error. The incident timeline, the identity tracker and the build log all carry corrections this way. To report one, write to hello@majorlabs.co with the page and the source you are relying on. Submissions with sources are reviewed within a week; nothing is added on the strength of an anonymous claim.

The weekly census history, the incident timeline and the identity tracker are published as machine-readable files on this site, versioned in a public repository, and deposited with a DOI at each quarterly report. The series compounds weekly and is never backfilled: a number published for a given week is the number that was measured that week, with that week's method. If a later method would have given a different number, the later method starts a new series.

Public code, public registries, public endpoints and public filings. Not private deployments, closed messaging between agents, or traffic inside an enterprise perimeter. Where a page implies coverage it does not have, that is an error under this charter and should be reported as one. The research directions document in the repository says which of those gaps the lab intends to close, and how.