How a grade is computed

A grade is a roll-up of the findings in one graded category. It is not a single score for the whole asset.

Graded categories

Two categories are graded: Safety, and Reliability & Quality. Each produces its own letter grade, computed independently from the findings in that category. The other categories are measured or unjudged and produce no grade; the category table on the methodology page shows which is which.

The thresholds

A grade moves from A toward F by severity. Severities are counted within one category, the thresholds are evaluated from F to A, and the first tier whose condition is met wins. Info findings never count.

Low-severity findings only (fewer than 4 lows)

No medium, high, or critical findings in this category, and fewer than four lows.

4 or more lows, or any medium present (fewer than 3 mediums)

Pattern-level findings with no confirmed data flow to a vulnerability, or at least one known weakness class.

3 or more mediums, or any high present (fewer than 3 highs)

One or more findings with conditional exploitability, or serious harm conditional on an additional factor.

3 or more highs, or any critical present

At least one critical finding, or three or more high findings in the category.

Severities

Every finding carries one of five severities. Severity decides whether a finding counts toward a grade: info never does, and every other level feeds the grade for its category.

critical

Adversarial intent, or a pattern that fires unconditionally in the context where it appears, with no exploitability preconditions.

high

Serious harm, but conditional on one more factor: caller-controlled input reaching the vulnerable operation, a specific environment, or a permissive configuration.

medium

A known weakness class with conditional exploitability, limited impact in isolation, or meaningful false-positive risk.

low

A heuristic match only. It has a high false-positive rate and no confirmed data flow to a vulnerability.

info

An observation with no direct harm path that does not contribute to a grade.

What a grade is not

A grade exists only for graded categories, and only when there is something to grade. A graded category with nothing to report is not assessed. Not assessed is not the same as clean. Measured and unjudged categories have no grade at all and are reported as what they are, never as a pass or a fail.