title: How are build / code coverage badges generated by 3rd-party sites?
body: <p>My work setup includes a company-hosted Github Enterprise Server and Azure Devops pipelines. With sites like <a href="https://shields.io/" rel="nofollow noreferrer">shields.io</a>, I can generate badges for build success or code coverage, seemingly without ever authenticating myself with DevOps. The badge is then hosted on shields.io, meaning this 3rd-party site must somehow have access to my build process. They look like this:</p>
  
  <p><a href="https://i.stack.imgur.com/xuQP4.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/xuQP4.png" alt="enter image description here"></a></p>
  
  <p>Since the github as well as all build pipelines are obviously company internal, I can see three options how this might work:</p>
  
  <ol>
  <li><p>Even though pipelines and everything are private, build success status is hosted openly for the whole web. This is by design, since it isn't really considered a security risk. Nothing else can be done with knowing the Organization/ProjectName/DefinitionID of my internal project.</p></li>
  <li><p>This should not happen and something is configured wrongly. I might have a vulnerability in my setup.</p></li>
  <li><p>There is some form of authentication going on that I do not know about, e.g. I can only see the badge as long as my browser is logged into Azure (unlikely, it seems to work in private mode as well)</p></li>
  </ol>
  
  <p>I can't find anything on the web or on stackoverflow regarding this. I would be happy about any resources explaining about this since I am not sure whether I can use them safely. Is using shields.io a security risk?</p>