How the health score is calculated

The arithmetic

Every project starts at 100. Each open critical finding costs 22 points, each high costs 9, each medium costs 3, each low costs 1, and info-level findings cost nothing. Penalties saturate: criticals can cost at most 60, highs 25, mediums 12, lows 3. The caps sum to 100, so the score bottoms out at zero rather than going negative.

Saturation is the decision doing the quiet work: forty medium findings never score worse than one critical, because the score is meant to rank danger, not clutter. Letter grades map from the resulting number: A at 90 or above, B at 75, C at 55, D at 35, F below that.

What moves it

Exactly one input moves the score: the multiset of open findings by severity on the latest completed scan. Resolving a critical lifts the score more than clearing a shelf of mediums, and a regression that reopens an old critical lands with its full original weight.

Resolution is observed, not assumed: the score changes when a scan confirms the fix, which is also why pressing Scan-now after deploying is the fast path to getting credit for your work.

What does not move it

Traffic does not move it, table size does not, plan tier does not, and neither does the age of a finding or the number of scans run. Nothing is averaged over time and no baseline is invented. Two projects holding the same open findings carry the same score, whatever else differs about them.

Reading it alongside the list

Worked example: one critical plus two highs costs 22 plus 18, scoring 60, a C. Fix the critical and clear one high, and the same project sits at 69 with the remaining high still named in the findings list.

Treat the score as a headline and the list as the article. Two projects can share a score for different reasons, one carrying a single critical and the other a stack of mediums, which is precisely why the counts beside the score break severity out separately.

A falling score is information, not judgement: it usually means a scan noticed something new, which is the monitoring working. Check what changed in the findings list before assuming the project got worse overnight, because a newly visible finding and a newly created one read identically on the number and nothing alike in the timeline.

Related questions

Why did my score not change after I fixed something?

Scores update when a scan observes the fix, not when the migration lands. Run Scan-now, and if the finding resolves, the score rises immediately afterwards.

Is a perfect 100 meaningful?

It means the latest completed scan found no open findings at the scored severities. That is a factual statement about one scan, and it is not a certificate about the next one.