How grades work

Every finished scan gets a grade from A to F. It's worked out from the report's critical and high findings only, so it says one thing: how exposed the app is right now.

The scale

• A: no critical and no high findings
• B: no critical, 1–2 high
• C: no critical, 3–5 high
• D: 1 critical, or 6 or more high
• F: 2 or more critical

What counts

A finding counts at its full severity when it's confirmed: the AI review confirmed it, or a deterministic check is highly confident. A finding marked (verify), or one the review was less sure of, counts one level lower: a critical "(verify)" counts as a high, and a high "(verify)" doesn't count at all. A grade shouldn't hinge on something nobody has confirmed.

Left out of the grade entirely:

• dependencies that are only used in development,
• findings in code that looks deprecated,
• the bonus sections (SEO, accessibility and compliance),
• "Not checked" coverage notes,
• findings you marked as a false positive.

Quick or Deep

The grade notes which checks it covers. A Quick scan's grade covers the deterministic checks. A Deep scan's also covers the AI review of access control and business logic, so it can go down after a Deep scan finds something the Quick checks can't see.

Live site only

A project with just a live URL and no code is graded on the live checks only: HTTPS, headers, cookies, DNS and email records, and the JavaScript the site serves (plus exposed files and open Supabase or Firebase data on a verified domain). The report says "Live site only — code not scanned" and lists what was and wasn't checked. An A there means the outside of your site looks right, not that the app is: add the code for the full scan.

On the dashboard, a project's grade is its latest finished report, and the average grade is the mean of those across your projects.