Sash

It is a parody. It copies the visual language of professional credentials, the rosettes, the guilloche, the serial number, the seal, the phrase "this is to certify that", because that language is funny when it is applied to Survived The Migration or Answered The Page At 3am. Those conventions belong to the genre rather than to any company, which is why they are free to borrow and why Sash draws its own from scratch instead of copying anybody's artwork.

It is not a professional qualification, it is not a licence to practise anything, it is not accredited by any body, and nobody assessed you. If a Sash badge says you are an expert, the only thing that made it true is that a friend clicked a button.

Every badge and every certificate carries a strip with three things on it: the word NEORGON or COMMUNITY next to the word BADGE or CERTIFICATE, the handle of whoever issued it, and the address of the page that verifies it. It is drawn by the renderer, inside the artwork, not added by the page around it.

That distinction is the whole point. A disclaimer that lives in page furniture disappears the moment somebody saves the image, and it is worse than no disclaimer at all, because it creates the impression that a control exists. Sash's renderer refuses to draw anything without a provenance object, and it ignores an attempt to switch the serial or the verify line off. Save the PNG, export the SVG, print it to PDF: the strip is in all three, because it is in the only drawing path there is.

Naming a real certification body is the line between a joke and a lie, so it is not left to a style guide. When anyone publishes a template, the server checks the name, the description, the criteria, the text on the arcs, the ribbon and every line of a certificate against a list of real issuers and their common abbreviations. A hit refuses the publish, returns the term it matched, and logs the attempt. Nothing is written.

The message it returns says what the rule actually is: the issuer of every Sash credential is Sash. Put whatever you like in the description.

Where this control stops. The match is case insensitive, folds accents, treats hyphens as spaces and catches a possessive. It misses plurals, so a term added as snowflake does not catch snowflakes, and it misses a name spelled out with separators, so A.W.S. reads as three separate letters and passes. Both gaps were found by probing the matcher rather than by reading it. The list is data and it grows without a deploy, so the honest description is that it catches the obvious attempt and that a determined author can get past it. It is a control, not a guarantee.

Two things are deliberately not checked. Your own free text everywhere else, which is where the parody lives. And the import path, which is the one place a real issuer's name belongs on this site.

You can bring a badge you earned elsewhere into your Sash wallet. When you do, it is shown as an import: the real issuer's name as the issuer sent it, the issuer's own artwork loaded from the issuer's own server, a link back to the source, and the date it was issued. It is never redrawn in Sash's badge style.

That is enforced by the shape of the data rather than by a rule a future author has to remember. An imported credential carries no design document at all, so there is nothing for the badge renderer to draw even if somebody asked it to. The failure this prevents is a profile where a real credential and a parody one share a single visual language, which would make the whole page dishonest at a glance.

Sash reads one badge at a time, the one you point it at, through the Open Badges address that the specification exists to have read. It does not read your wallet, your profile, or anyone's list of badges, and there is no scheduled job that goes back for more. When Sash checks a badge with its issuer, it can only report what the issuer answers: a badge it cannot reach stays labelled unverified, and a badge whose recipient it cannot match to your email is labelled as well rather than refused, because a real badge can be issued to an address you no longer use.

A Sash badge can be downloaded as a signed Open Badge. Inside that file the issuer is always Sash, at an address on this domain, described in one line as a maker of parody badges. The person who designed the template appears as the creator of the achievement, never as the issuer. That split exists in the Open Badges specification for exactly this reason, and it means a Sash credential can never become a machine readable claim about a real organisation.

A link to this page rides inside the signed payload. Strip it and the signature breaks, which is the strongest place to put a disclosure that a file format offers.

Verifying a credential proves who wrote it and that nobody edited it since. It does not evaluate whether what it says is true. That is the specification's own position and it is worth repeating here, because a green tick in a verifier is the easiest thing on this site to mistake for authority.

A downloaded file is a snapshot of the moment it was made. Revocation and expiry live on the badge's page on this site, which is the live answer.

Do not use a Sash credential to claim a qualification you do not have. Not on a job application, not in a hiring profile, not to get money or a promotion or a place on a course. The rules that exist about fake qualifications mostly attach to the person who uses one, not to the tool that drew it, and none of the controls on this page can help you if you take a joke badge somewhere it will be read as a real one.

Do not present a Sash badge as endorsed by a company, and do not build a template designed to be mistaken for a specific real one. The blocklist above catches the obvious version of that. Not being caught is not permission.

If a Sash credential misuses your name, your mark or your work, or if somebody is passing one off as real, tell us and we will act on it.

• Use the report control in the bottom left corner of any Sash page. It carries the address of the page you are on, so you do not have to describe where you saw the thing.
• Include the serial. Every badge and certificate has a ten character serial printed on it and in its address, and it identifies one artefact exactly.

What we can do about it: an issuer can revoke an award, and a revoked award says so on its page from that moment. A template can be archived so no more are issued. An imported credential can be removed by the person who imported it. Any copy already downloaded is a file in somebody else's possession, which is a limit worth stating plainly rather than a promise worth breaking.

None of the above is legal advice, and nobody involved in building Sash is a lawyer. It is a description of the rules this project chose, why it chose them, and how far each one reaches. Where a control has a hole, this page names the hole. A page that claimed the controls were complete would be doing the same thing it exists to prevent.