What the research program is
This is independent research on identity and authentication by Deepak Gupta. It studies how real brands and vendors handle login, passkeys, account recovery, pricing and related questions.
Every report is built on public, verifiable data. Every number in a published report traces back to stored evidence: the page, file or document it came from, captured at a recorded time.
I have no commercial relationship with the identity vendors named in these reports. GrackerAI is my company. Wherever its data or product is used in a report, that report says so.
Ethics and the limits of automated collection
These rules override any instruction in a report plan.
What automation does
- Fetches public pages that a logged-out visitor can see.
- Reads public JSON files, APIs and documentation within their published terms.
- Observes page structure: HTML attributes, the scripts a page loads, the network requests it makes on load, and the browser API calls it makes on its own.
- Watches whether a page asks the browser for passkey autofill. The test browser holds no credentials, and no credential request is ever completed.
- Uses openly licensed datasets, with the attribution the license asks for.
What automation never does
- Create accounts on third-party sites.
- Enter credentials, real or fake, into third-party login forms.
- Solve, bypass or outsource CAPTCHAs or bot checks. A site that blocks automation is recorded as
blocked. - Submit forms on third-party sites, including signup, login, password reset and contact forms.
- Contact support desks, chatbots or employees of the companies studied. The only contact is the right-of-reply email, sent by a person.
- Test whether an account exists for any email address or phone number the research team does not own.
- Collect personal data about any individual.
- Scrape AI chat products against their terms. Only official APIs are used.
Checks only a person does
Some checks need a logged-in account or a form submission, such as what a login form says when an email has no account. My team does these by hand, at normal human pace. They use accounts they created with their own identities and an email domain the team owns.
When robots.txt disallows a page for automation, the crawler records robots_disallowed and skips it. A team member may then view that public page by hand, in an ordinary browser.
Crawler identification
Automated requests identify themselves with this user agent:
guptadeepak-research/1.0 (+https://guptadeepak.com/research/methodology/)robots.txtis respected for every path fetched.- At most one request every 2 seconds to any one domain.
- At most 4 domains are crawled in parallel.
- Every response is cached. Nothing already cached for the current collection wave is fetched again.
- Requests to SEC EDGAR follow the SEC fair access policy, with a contact email in the user agent.
For site owners
To exclude your site, disallow the user agent guptadeepak-research in your robots.txt. The crawler honors it on its next fetch.
You can also write to research@guptadeepak.com to ask for exclusion or to report a problem, such as unexpected load or a misread page. Please include your domain and, if you can, the time of the requests.
Evidence standard
Every observation is stored with these fields:
| Field | What it holds |
|---|---|
entity_id | Stable ID of the site, vendor or product, from the report's frozen universe file |
check_id | ID of the check, from the report's published check catalog |
value | Normalized result: true, false, unknown, blocked, or a number |
method | How the value was observed: page HTML, a JavaScript hook, network requests, a well-known file, a dataset, a documentation review, or a manual check |
evidence_url | The exact URL observed |
evidence_path | Where the stored HTML snapshot, JSON file or screenshot is kept |
evidence_sha256 | Hash of that stored file, so later tampering would show |
captured_at | ISO 8601 UTC timestamp of the observation |
collector_version | Git commit of the code that collected it |
notes | Free text for edge cases |
unknown and blocked are real results. They are reported as their own categories and never counted as false. A missing signal is weak evidence, and the reports say so instead of treating it as proof.
Quality assurance
- Human verification sample. For every automated check, a person re-checks a random 10% of entities, with a minimum of 30. Agreement is reported per check. A check below 90% agreement is fixed and re-run, or dropped from the report.
- Double coding. Items scored against a rubric, such as documentation reviews, get two independent passes. The second pass is a manual review by my team. Agreement is reported, and disagreements are resolved in writing.
- Denominator discipline. Every percentage states its denominator.
blockedandunknownresults are left out of it unless the finding is about them. - Freshness. All observations in one edition fall within a 30-day window, and each report states its window.
- Reproducibility. Every published number can be reproduced from the processed data with one command.
Right of reply
Every company named in the text of a report receives its own results and evidence 10 business days before publication. A person sends that notice, with a way to send corrections. Companies that appear only in a results table do not get advance notice. Replies are logged, and any correction they lead to is made before publication.
Data access
Results are published on guptadeepak.com as results pages, with tables and charts. There are no downloadable files, and nothing is hosted on a third-party data platform. To cite a result, cite the report page and the edition.
Editions
Each report has one stable URL that always shows the latest edition. When a new edition ships, the previous one moves to an archive page tagged with its year, for example /research/<report>/2027/. Two editions of the same report are never live as current at once.
Corrections policy
If you find an error, write to research@guptadeepak.comwith the page, the number in question and what you believe is correct. I check the claim against the stored evidence. Confirmed errors are fixed on the page, and the fix is listed in that report's dated changelog. Changes to this methodology are listed below.
Reports in progress
These reports are being built under this methodology. None has published findings yet.
- State of Brand Login: in progress
- Passkey Readiness Index: in progress
- SMS Dependency Report: in progress
- Account Recovery Exposure: in progress
- CIAM Pricing Index: in progress
- Identity Vendor Survival: in progress
- AI Agent Identity Readiness: in progress
- AI Search Visibility of Identity Vendors: in progress
Changelog
- : Methodology published.