RISK SCORE
One number per scan, 0 to 100, derived only from confirmed findings by severity. It is deliberately simple so a drop after a fix is unambiguous.
Formula
risk = min(100, critical × 35 + high × 20 + medium × 10 + low × 3)
Info findings weigh 0. Findings marked False positive or Fixed are excluded. Findings you Ignore locally are subtracted in your own dashboard view only.
Bands
| Score | Band | Gauge color |
|---|---|---|
| 0–24 | Low | Green |
| 25–49 | Medium | Yellow |
| 50–74 | High | Orange |
| 75–100 | Critical | Red |
Where it appears
- Scan page — semicircular gauge with the band label, plus the delta versus the previous scan of the same target.
- Dashboard — Avg Risk Score KPI across your targets and a per-scan Risk column in the Recent Scans table.
- Targets — per-severity counters that feed each target’s most recent score.
- Trust badge and verify page — the live score of the latest completed scan.
Worked examples
| Findings | Calculation | Score |
|---|---|---|
| 1 critical, 2 high | 35 + 40 | 75 (Critical) |
| 3 medium, 4 low | 30 + 12 | 42 (Medium) |
| 5 low | 15 | 15 (Low — badge eligible) |
| 2 critical, 1 high, 6 medium | 70 + 20 + 60 = 150 | 100 (capped) |
What moves the score
- Fixing and retesting a finding removes its weight once the retest passes and the status becomes Fixed.
- Archiving a scan sets its contribution to zero in dashboard aggregates.
- On-call review can add findings automation missed or remove ones it got wrong, so the score can move in either direction between pending review and completed.
/ FAQ
COMMON QUESTIONS
01
Why is my score 100 with only three findings?
Three criticals alone reach the cap: 3 × 35 = 105, capped at 100. The score is designed to saturate quickly on critical issues so a single exposed database key or missing RLS policy is not diluted by a long list of passed checks.
→
02
Do Info findings affect the score?
No. Info carries a weight of zero. Passed checks and false positives also contribute nothing.
→
03
What score do I need for a trust badge?
15 or lower on a completed scan. That allows at most five Low findings, or one Medium plus one Low.
→
/ NEXT STEP
SEE IT ON YOUR OWN APP
Docs explain the product. A scan shows you what it finds on your deployed URL — keys, RLS, auth, and API gaps in under 60 seconds.
14-day free trial · No credit card · Cancel anytime
