Why secrets carry almost a third of the score
Every repo is scored across six categories, and they don't count equally. Secrets & credentials carries weight 30, almost a third of the total, because a committed live key is the most directly exploitable thing a repo can contain. Injection & unsafe code is 20. Auth & access control and data exposure are 15 each. Dependencies & supply chain and transport & TLS are 10 each.
The weighting is the opinionated part, tuned to vibe-coded apps: the issues that are both most common in AI-generated codebases and most damaging when public get the most influence. A repo with perfect code and one committed Stripe key scores far worse than a repo with clean secrets and a missing lockfile. Which is the right way round, if you ask which of the two can cost you money by Friday.
The deduction table, worked through
Start each category at 100. Then subtract per finding: 40 for a critical, 22 for a high, 10 for a medium, 4 for a low. Those subtractions stack. One critical and two mediums in the same category leaves it on 100 − 40 − 10 − 10 = 40, and the overall score is the weighted average across all six.
Take a repo with one critical secret finding and one high injection finding, everything else clean. Secrets drops to 60, injection to 78, and the overall lands at (60×30 + 78×20 + 100×15 + 100×15 + 100×10 + 100×10) / 100 = 73.6, a C. Fixing that one secret recovers 12 weighted points by itself. That's why it sits at the top of your findings list.
What the letter grade means, and what it doesn't
The bands: 90 and above is an A, 80 a B, 65 a C, 50 a D, and anything under 50 is an F. An A means the scan found nothing serious. A C means real findings worth a fixing session. A D or F almost always means at least one critical issue, usually a committed secret, and that one gets handled today, starting with credential rotation.
Two boundaries. The score sees only what pattern-based static checks can see: no code execution, no CVE database, no pentest, so 100 reads as "clean against these checks" rather than "invulnerable". And it earns its keep as a delta. Run a scan, paste the prompts into Claude Code, run it again, watch the grade move. The two free scans cover exactly that loop.
quality·vibes's scoring system at a glance
| Component | Value | Meaning |
|---|---|---|
| Secrets & credentials | weight 30 | Committed keys, hardcoded passwords, credentialed connection strings |
| Injection & unsafe code | weight 20 | String-built SQL, eval/exec, shell-from-variables, unsafe deserialisation |
| Auth & access control | weight 15 | Debug mode, wildcard CORS, default/none JWT secrets, cookie flags |
| Data exposure | weight 15 | Committed .env, key files, service-account JSON, dumps, .gitignore gaps |
| Dependencies & supply chain | weight 10 | Lockfiles, version pinning, raw-URL deps, curl|sh installs |
| Transport & TLS | weight 10 | Disabled TLS verification, plain-http calls, missing helmet on Express |
| Deductions per finding | crit −40 / high −22 / med −10 / low −4 | They stack, down from each category's starting 100 |
| Grades | A ≥90 · B ≥80 · C ≥65 · D ≥50 · F <50 | Applied to the weighted average of all six categories |
frequently asked
Why is one critical finding worth −40?
Because a critical finding, a live committed key say, isn't a 10% problem. The deduction is sized so one critical drags its category to 60 and dents the overall grade visibly, which matches how urgent it is to fix.
Can a category score go below zero?
It floors at zero. Deductions stack per finding, and once a category is on the floor the exact number stops meaning much. Read it as a flag instead: that category needs a session of its own, worked in the order the report ranks it.
Is a score of 100 a guarantee my app is secure?
No. Nothing turned up across the pattern-based checks, and that's worth something. But quality·vibes never executes code, never consults a vulnerability database, and isn't a pentest. A 100 is a clean first pass, not a certificate.
How do I improve my score fastest?
Work the findings list from the top. It's already sorted by severity and category weight, so one critical secret is worth more to you than every low finding in the report combined. Each finding carries its own Claude prompt, so a fix is a paste rather than a project.
Last updated June 10, 2026