Risk Scoring
Learn how each finding contributes to the final risk score and risk level.
Score model
- Findings contribute points by severity and code (with caps for injection and secrets).
- Dangerous permission combinations add bonus risk.
- Tools with any declared permissions carry a small ambient baseline.
- Final score maps to LOW / MEDIUM / HIGH / CRITICAL and a letter grade (A+–F).
Levels
- 0–29 → LOW
- 30–59 → MEDIUM
- 60–79 → HIGH
- 80–100 → CRITICAL
Sample configs are validated with npm run verify:samples against documented score ranges.