How the Security Score works

Grades

Category weights

The score is a weighted aggregate across scanner categories. Current weights (scoring version security-score-v5):

VirusTotal, GDPR, platform detection and reputation carry zero weight, so they do not add points. Confirmed VirusTotal and reputation outcomes can still apply the separate caps documented below.

Score caps

Some findings are severe enough that a weighted average would be misleading. Caps override the aggregate:

• Any confirmed critical finding caps the score at 30.
• A domain listed on a reputation blocklist caps the score at 20.
• VirusTotal multi-vendor verdicts apply the published tiered caps from methodology registry security-score-v5.

A site with perfect headers and an exposed .envfile is not a B — it’s compromised-in-waiting. Caps encode that.

The Boring Score

AI-assisted apps fail in characteristic ways, so scans also produce a Boring Score with weights shifted toward those failure modes. Its current category weights are derived from the runtime configuration below. Critical findings cap the Boring Score at 25.

Honesty rules

• Coverage-aware. Every report ships with a per-category breakdown and a coverage ratio (weight actually assessed ÷ weight planned). If coverage falls below 85%, or any category weighted ≥0.10 was unavailable, the overall score and grade stay N/A. Coverage telemetry may be provisional, but no numeric provisional overall score is published.
• Withheld, not dropped.Categories we couldn’t assess are listed as withheld coverage. We never silently shrink the denominator to make the number look better.
• Evidence policy. Any critical or high finding that lacks captured proof is automatically downgraded to medium, with a disclosure in the finding text. Unproven findings cannot cap your score.
• Versioned. Every score records its scoring version, so historical scores stay comparable after weight changes.

FAQ