Badge API returns 403 (Cloudflare challenge) — GitHub README badges broken

[omrfc]

Description

The Socket badge API endpoint (https://socket.dev/api/badge/npm/package/<name>) is returning a Cloudflare challenge page (403) instead of the SVG badge. This breaks badge rendering on GitHub READMEs and any automated badge consumers.

Steps to reproduce

curl -sI "https://socket.dev/api/badge/npm/package/kastell"
# Returns: HTTP/1.1 403 with Cloudflare challenge HTML

Expected behavior

The badge endpoint should return an SVG image without requiring JavaScript/cookie-based Cloudflare verification, since badge consumers (GitHub camo proxy, shields.io, CI tools) cannot execute JavaScript.

Actual behavior

• GitHub README shows a stale/cached badge or "in progress" text
• curl and other HTTP clients receive a 403 with Cloudflare challenge page
• The socket.dev website itself shows the correct score (e.g., 73 for kastell)

Environment

• Package: kastell (npm)
• Badge URL: https://socket.dev/api/badge/npm/package/kastell
• Tested from multiple locations and user agents

Suggestion

Consider allowlisting the /api/badge/ path from Cloudflare's managed challenge, similar to how shields.io and other badge services handle their SVG endpoints.

[omrfc]

Still seeing 403 from Cloudflare on the badge endpoint as of today (March 20).

curl -sI "https://socket.dev/api/badge/npm/package/kastell"
→ HTTP/1.1 403 Forbidden
→ Cf-Mitigated: challenge

Our package scores 73 on socket.dev but the badge won't render on GitHub — it just shows a loading/broken state. This affects every repo using the Socket badge in their README.

Is there a timeline for allowlisting /api/badge/ from the Cloudflare managed challenge?

[omrfc]

Additional issue: Cannot create organization on socket.dev dashboard.

GitHub App is installed for kastelldev org, OAuth access is granted, but https://socket.dev/dashboard/create-organization keeps redirecting back to itself after selecting the GitHub org. Unable to access the dashboard at all.

So we have two issues now:

1. Badge API returns 403 (Cloudflare challenge) — original report
2. Dashboard org creation loop — cannot onboard