# Zapier: -4 point Door Gap
- Site: zapier.com
- Scanned: 2026-09-10
- Scan type: Basic scan
- Business type: b2b_saas
- Report: https://www.seconddoor.io/r/zapier-snwaed
- Scanner version: 51
- Scanner release: 6da0c16
- Scoring methodology: 1
- Evidence schema: 1
2 human and 5 agent dimensions measured from the pages checked; remaining dimensions are not scored.
## Scores
| Measure | Score |
| --- | --- |
| Humans | 77/100 (2/4 dimensions) |
| Agents | 81/100 (5/6 dimensions) |
| Composite | 79/100 |
| Door Gap | -4 points |
The human score is the mean of the measured human dimensions, the agent score the mean of the measured agent dimensions, and the Door Gap the difference between them.
## What the machine actually did
The scanner recorded successful observations for 11 of 14 checks, but could not find a contact route for machines. It came up empty on 2 other checks too. 1 check could not be measured; see the report limitations.
- ok      reach the site at all
- ok      find out whether machines are welcome
- ok      ask whether the door opens for requests carrying the AI crawlers' names
- ok      read the site's own guide for language models
- ok      find out what pages exist
- missing find a contact route for machines
- ok      find an MCP manifest at the standard paths checked
- missing find an agent plugin manifest
- missing find out whether verified agents are recognised
- ok      read the homepage as data rather than as a page
- ok      read the developer documentation
- ok      read the prices without running JavaScript
- ok      find a comparison page worth citing
- ok      walk the way a visitor would, to a signup form or a product
## What a visitor meets
1. **Entry observation** (observed). Primary entry is "Sign up Sign up". 2 steps from the homepage. 3 fields, 3 marked required in the visible form. 1 sign in option: google. 0 of 3 visible entry-form inputs carry validation attributes; submission was not tested.
## Top issues
1. **No valid security.txt was identified at /.well-known/security.txt.** (machine_fetchable_trust)
   - Evidence: /.well-known/security.txt: not found (404)
   - Evidence: Checked URL: https://zapier.com/.well-known/security.txt
   - Fix: Publish /.well-known/security.txt with a contact route.
The full report is at https://www.seconddoor.io/r/zapier-snwaed
## Files generated from this scan
- **security.txt** at `/.well-known/security.txt`, 10 minutes, no developer needed. Verify: The next scan fetches /.well-known/security.txt as text and the security.txt check passes.
- **Machine interfaces: where you stand** at `notes`, 10 minutes, no developer needed. Verify: The next scan finds the interface you published answering at its well-known path, and that check passes.
Each file is written from what this scan found on the site. The content is in the JSON once the evidence is opened: https://www.seconddoor.io/api/reports/zapier-snwaed
## The agent door
- **machine_discoverability** 100/100. Robots.txt explicitly names 8 AI crawler tokens; policies differ by token. On its first visit, our browser read the homepage. No user agent rule refused the tested retrieval crawler names.
- **programmatic_onboarding** not measured. Not measured: our scanner could not identify the required evidence on the pages checked.
- **pricing_legibility** 93/100. 3 prices are readable without JavaScript. An enterprise tier routes to sales, which is standard practice and not counted against the score. The plans are published as Offer structured data too.
- **agent_aware_instrumentation** 90/100. An MCP manifest is published. Robots.txt explicitly names 8 AI crawler tokens; policies differ by token. Pricing.md publishes prices in a form an agent can read directly. Developer documentation describes an API, but only in prose.
- **machine_fetchable_trust** 40/100. No security.txt was identified at the checked path. The homepage answers automated requests.
- **commercial_rails** 80/100. Prices are published in raw HTML. A self-serve signup entry was observed from the homepage. Pricing.md is machine readable. The plans are published as Offer structured data.
## The human door
- **steps_to_first_value** 80/100. A signup form was reached in 2 steps from the homepage.
- **required_fields** 73/100. 3 of 3 fields on the observed form are marked required. 1 sign-in provider is displayed.
- **verification_walls** not measured. Not measured: this read-only scan did not submit the form or perform the action needed to test this behavior.
- **error_recovery** not measured. Not measured: this read-only scan did not submit the form or perform the action needed to test this behavior.
---
Scored by SecondDoor. Method: https://www.seconddoor.io/methodology
Scan another site: https://www.seconddoor.io
Rate an issue or this report: POST https://www.seconddoor.io/api/feedback, or the rate_fix tool on https://www.seconddoor.io/api/mcp