Every check, every weight, in public.

How the grade is weighted

• Claims and functionality25%
• Security20%
• Billing integrity10%
• Code quality and maintainability10%
• Tests and CI10%
• Dependencies, licensing and IP10%
• Operability and transferability10%
• Provenance and bus factor5%
• AI and LLM economics8%

1. MV-2026.3In force from 8 August 2026
   Changes grades

   Keys a provider publishes on purpose, such as a Stripe publishable key or a Supabase anon token, report as info rather than as leaked credentials.

   • AddedA `publishable` credential state, and rule SR-02C, which scores it info. A secret scanner matches shape, so it cannot tell a Stripe publishable key from a secret one, and it reports a Supabase anon token as loudly as a service_role token. Every such value is compiled into the app by design and is already readable by anyone who installs it, so there is nothing to leak and nothing to rotate. Previously they landed at high under SR-03, which put several rows saying "rotate this" beside any finding that was real. The state is asserted only from the value's own shape, never from a variable name: a service_role key behind a NEXT_PUBLIC_ prefix stays a credential exposure, because the prefix means it is compiled into the bundle. Grades can therefore rise for repositories that ship a client, most visibly mobile apps; certificates issued under MV-2026.2 keep the severities that version produced.
2. MV-2026.2In force from 7 August 2026
   Changes grades

   Secret findings whose only citation is test or unreachable code report as medium rather than high.

   • ChangedSR-03, which treats an unverifiable credential as live, now applies only where the code is reachable in production. Previously it matched everywhere and shadowed SR-11, so a credential-shaped fixture in a test file scored the same as a key in production source. SR-11 already covers the test case at medium, and SR-02 still rates a credential that verifies as live critical wherever it sits. Grades can therefore rise for repositories carrying secret findings in test code; certificates issued under MV-2026.1 keep the severities that version produced.
3. MV-2026.1In force from 6 August 2026
   No effect on grades

   First published version.

   • AddedNine scored dimensions with public weights, the deduction table, the repeat-decay curve, the per-check caps, and the grade bands.
   • AddedThe check catalog: what each check looks at, the most severe thing it is allowed to raise, and whether it appears in the free preview.
   • AddedThe severity rubric. Findings carry facets, the rubric turns facets into a severity, and the check's ceiling applies last. No model assigns a severity.

• INV-01Language and LOC censusUp to infoFree

  Count languages, lines of code, and file distribution

• INV-02Stack fingerprintUp to infoFree

  Identify frameworks, runtimes, and datastores from manifests and lockfiles

• INV-03Service topologyUp to infoFree

  Map deployables, workers, cron jobs, queues, and entry points

• INV-04Third-party service mapUp to infoFree

  Every external SDK or API the code touches, with what it is used for

  Preview: map shown free; estimated costs are locked

• INV-07Architecture narrativeUp to infoTeaser

  Plain-English account of how a request becomes a response

  Preview: first paragraph shown free

• INV-08Scope and package boundary mapUp to infoFree

  Workspaces and packages in scope, with any seller-requested exclusions named

• CLM-01Claim decompositionUp to infoFree

  Split the listing text into discrete testable claims, up to five marked core

• CLM-02Claim-to-code mappingUp to infoTeaser

  Map each claim to routes, handlers, jobs, schema, and tests that implement it

  Preview: two sample rows shown free

• CLM-03Claim verdictsUp to criticalTeaser

  Verified, partial, unverified, or contradicted against a fixed rubric

  Preview: counts only

• CLM-04Hardcoded data on production pathsUp to criticalTeaser

  Fixture or seed data served to real users as if it were live

• CLM-05Mocked integrations and stub featuresUp to criticalTeaser

  Fake API clients, demo branches, or claimed features dark behind flags

• CLM-06Dead-end UIUp to highFull report

  Buttons or menus for claimed features that lead nowhere

• CLM-07Runtime smoke of core claimsUp to highTeaser

  Boot the app and exercise signup through the core action

  Preview: runtime-verified badge count only

• CLM-08Entitlement audit of claimsUp to highFull report

  Confirm a paying user can actually reach each claimed feature

• CLM-09Integration authenticityUp to highTeaser

  An advertised integration makes real API calls, not a deep link or mailto

• CLM-10Scale-claim sanityUp to mediumFull report

  Claims like "built for teams" are backed by a real multi-user model

• SEC-01Secrets in the working treeUp to criticalTeaser

  Live credentials committed in current files

  Preview: count only, never the secret

• SEC-02Secrets in git historyUp to criticalTeaser

  Credentials anywhere in the full history, including deleted files

• SEC-03Vulnerable dependenciesUp to criticalTeaser

  Known CVEs from lockfiles, triaged for whether the vulnerable path is reachable

  Preview: counts by severity

• SEC-04Multi-tenant data isolationUp to criticalTeaser

  Every tenant-scoped query filters by tenant, and object ids are not guessable handles

  Preview: pass or fail verdict badge only

• SEC-05Authentication implementationUp to criticalFull report

  Session and token handling, password hashing, reset flows, OAuth configuration

• SEC-06Authorization and admin routesUp to criticalFull report

  Role enforcement on privileged endpoints

• SEC-07InjectionUp to criticalFull report

  SQL, NoSQL, and command injection paths

• SEC-08XSS and CSRF postureUp to highFull report

  Output encoding, and CSRF protection where cookies authenticate requests

• SEC-09Server-side request forgeryUp to highFull report

  Server-side fetches of user-supplied URLs

• SEC-10Webhook signature verificationUp to criticalTeaser

  Inbound webhooks verify signatures before acting, Stripe especially

• SEC-11File upload handlingUp to highFull report

  Type and size validation, path traversal, storage bucket permissions

• SEC-12Rate limiting and abuse controlsUp to mediumFull report

  Limits on authentication and on expensive endpoints

• SEC-13Admin and debug backdoorsUp to criticalFull report

  God-mode parameters, debug routes, default credentials, commented-out auth

• SEC-14PII in logsUp to mediumFull report

  Emails, tokens, or card fragments written to logs

• LIV-01TLS configurationUp to mediumFull report

  Protocol versions and certificate validity

• LIV-02Security headersUp to mediumFull report

  Content security policy, HSTS, frame options, content-type options

• LIV-03Cookie flagsUp to highFull report

  Secure, HttpOnly, and SameSite on session cookies

• LIV-04Exposed debug surfacesUp to criticalFull report

  Debug routes, stack traces, or source maps reachable in production

• LIV-05Version disclosureUp to infoFull report

  Headers or error pages that leak stack versions

• LIV-07Webroot leaksUp to criticalFull report

  Version control or environment files reachable over the web

• BIL-01Payment provider inventoryUp to infoFree

  Which provider, and whether checkout, subscriptions, or payment links are used

• BIL-02Webhook event completenessUp to highFull report

  Handles checkout completed, subscription updated and deleted, invoice failed

• BIL-03Server-side entitlement enforcementUp to criticalTeaser

  Whether a free user can reach paid features or paid API routes directly

  Preview: pass or fail verdict badge only

• BIL-04Plan gating matches the pricing pageUp to highFull report

  Limits and tiers in code agree with what the public pricing page promises

• BIL-05Trial logicUp to highFull report

  Trial expiry enforced on the server, not only in the client

• BIL-06Cancellation and downgradeUp to highFull report

  Access is actually revoked on cancellation or expiry, with sane grace handling

• BIL-07Dunning pathUp to mediumFull report

  A failed invoice changes account state instead of failing silently

• BIL-08Webhook idempotency and replayUp to mediumFull report

  Duplicate and out-of-order events are tolerated

• BIL-09Price integrityUp to criticalFull report

  Amounts are not client-supplied, coupons cannot be abused, currency is handled

• BIL-10Key and mode hygieneUp to mediumFull report

  Test keys or test-mode branches reachable from production paths

• INV-05Dependency graph healthUp to mediumFull report

  Circular dependencies and orphan modules

• INV-06Repo hygieneUp to mediumFull report

  Committed build output, node_modules, .env files, or large binaries

• QLT-01Complexity hotspotsUp to mediumFull report

  Highest-complexity files measured against corpus norms

• QLT-02DuplicationUp to mediumFull report

  Token-level clone percentage across the codebase

• QLT-03Typing disciplineUp to mediumFull report

  Strictness settings and the density of untyped escape hatches

• QLT-04Dead codeUp to mediumFull report

  Orphan modules, unused exports, and abandoned features

• QLT-05Error-handling disciplineUp to highFull report

  Swallowed exceptions, bare catches, and missing awaits

• QLT-06Documentation accuracyUp to mediumFull report

  Whether the README and setup steps match what the code actually needs

• QLT-07Configuration hygieneUp to mediumFull report

  Hardcoded URLs and values that belong in configuration

• QLT-08CoherenceUp to mediumFull report

  Mixed paradigms, half-finished refactors, and inconsistent naming

• QLT-09Onboarding estimateUp to infoFree

  Hours before a mid-level developer could make a safe change, against a rubric

• QLT-10Framework misuseUp to mediumFull report

  Fighting the framework, or hand-rolling what the platform already provides

• TST-01Test inventoryUp to infoFree

  Frameworks in use, test counts, and the unit to integration to end-to-end mix

• TST-02Suite runs coldUp to highTeaser

  From a fresh clone, install and run the suite, and see whether it passes

  Preview: pass or fail badge

• TST-03Line and branch coverageUp to infoTeaser

  Coverage from an instrumented run of the project's own suite

  Preview: coverage tier, not the exact figure

• TST-04Critical-path coverageUp to highTeaser

  Whether auth, billing, and the core domain are covered, or only trivial code

• TST-05Assertion qualityUp to mediumFull report

  Tests with no assertions, snapshot-only tests, or assertions that cannot fail

• TST-06CI exists and gatesUp to mediumFull report

  A workflow that runs tests on pull requests, and whether it is recently green

• TST-07Skipped and flaky debtUp to mediumFull report

  Density of skipped, focused, and commented-out tests

• TST-08Static gatesUp to infoFull report

  Lint, format, and typecheck wired into CI

• DEP-01License inventory and sale compatibilityUp to criticalTeaser

  Full license census weighed against a closed-source commercial transfer

  Preview: risk badge only

• DEP-02Copyleft contamination pathUp to criticalFull report

  Whether a copyleft dependency is actually linked or served, or only used in dev

• DEP-03Vendored code of unknown originUp to highFull report

  Copied files or snippets carrying no license or attribution

• DEP-04Paid assets requiring transferUp to highTeaser

  Commercial themes, fonts, icon sets, or UI kits the buyer must re-license

  Preview: count only

• DEP-05Outdated majorsUp to mediumFull report

  How far behind current the dependency tree runs, and the maintenance lag implied

• DEP-06End-of-life runtimes and frameworksUp to highTeaser

  Runtimes or frameworks already past their published end-of-life date

• DEP-07Deprecated third-party APIsUp to highFull report

  Calls to sunset APIs, and pinned legacy API versions

• DEP-08Abandoned critical dependenciesUp to mediumFull report

  Unmaintained or single-maintainer packages on load-bearing paths

• DEP-09Supply-chain surfaceUp to infoFull report

  Dependency count against application size, and what postinstall scripts run

• DEP-10Lockfile integrityUp to mediumFull report

  A lockfile exists, is committed, and agrees with the manifest

• INV-09Data model inventoryUp to mediumFull report

  Tables and models present, migrations present and linear

• OPS-01Clean-room deploy dry runUp to highTeaser

  Follow only the written docs from a fresh clone to a running app, and time it

  Preview: verdict badge and elapsed minutes

• OPS-02Environment variable inventoryUp to mediumTeaser

  Every variable the code reads, against what the documentation lists

  Preview: counts only

• OPS-03Account transferabilityUp to highFull report

  Each third-party account, and whether it can transfer or is tied to a person

• OPS-04Monthly run-cost estimateUp to infoTeaser

  Infrastructure, SaaS, and usage-tier costs, itemized

  Preview: line items listed, figures locked

• OPS-05Vendor lock-inUp to mediumFull report

  Proprietary services with no export or migration path

• OPS-06Backup and restore realityUp to highFull report

  Whether backups are configured and a restore path actually exists

• OPS-07Observability floorUp to mediumFull report

  Error tracking, logs, and uptime checks present

• OPS-08Scalability red flagsUp to highFull report

  N+1 queries, missing indexes, and unbounded queries on hot paths

• OPS-09Founder-only operationsUp to highTeaser

  Manual jobs, personal API keys, and deploy steps that live only in someone's head

• OPS-10Reproducible configurationUp to mediumFull report

  Dockerfile, compose, or infrastructure-as-code present and coherent

• OPS-11New-environment data pathUp to mediumFull report

  Migrations plus a seed path for standing up a fresh instance

• LIV-06Deploy against repo driftUp to highFull report

  Whether observable version markers match the certified code

• PRV-01History sanityUp to highTeaser

  Detect a fresh single-commit dump presented as a long-lived product

  Preview: badge only

• PRV-02Rewrite signalsUp to mediumFull report

  Shallow or grafted history, author against committer date anomalies

• PRV-03Contributor and IP chainUp to highTeaser

  Who wrote what share, and contributors with no assignment on record

  Preview: contributor count only, never identities

• PRV-04Template-derivative estimateUp to mediumTeaser

  Overlap with known starter kits and commercial boilerplates

• PRV-05AI-generated share estimateUp to infoFree

  Estimated share of AI-authored code, with a confidence band

• PRV-06Copied-code provenanceUp to highFull report

  Files matching public repositories under incompatible licenses

• PRV-07Maintenance storyUp to infoFull report

  Commit cadence and whether a second maintainer is quietly load-bearing

• PRV-08Branch and release traceabilityUp to mediumFull report

  Whether the main branch matches what is released, and what sits on stray branches

• MET-01Scanner evasionUp to mediumFull report

  Blanket suppression files or inline ignore comments added to defeat scanning

• AIM-01Prompt and model inventoryUp to infoFree

  Every model call site, the models used, and whether versions are pinned

• AIM-02Unit economicsUp to highTeaser

  Estimated token cost of a core user action against what the plan charges

  Preview: margin-risk flag only

• AIM-03API key handlingUp to criticalFull report

  Model keys stay server-side, with no client-side model calls

• AIM-04Cost controlsUp to highFull report

  Token caps, per-user quotas, and guards against runaway agent loops

• AIM-05Model deprecation exposureUp to mediumFull report

  Pinned models already deprecated, and how hard migration would be

• AIM-06Wrapper thinnessUp to infoTeaser

  Whether anything beyond the prompt is proprietary, such as data, workflow, or evaluations

• AIM-07Prompt injection and output handlingUp to highFull report

  Untrusted content in prompts, unsanitized model output, and tool-use guards

• AIM-08Provider resilienceUp to mediumFull report

  A hard single-provider dependency with no abstraction or fallback

• AIM-09LLM data privacyUp to mediumFull report

  What user data reaches providers, and what retention settings apply