Web Scanner — Reading your report

Your scan report contains a Launch Score and a list of findings. Here is how to interpret both.

The Launch Score

A deterministic score from 0–100 based on a versioned rubric. It is reproducible — running the same scan twice will produce the same score. The score reflects the number and severity of findings, with critical findings (exposed API keys, expired TLS) weighted heavily.

Finding severity

• Critical — Fix before launch. Exposed API keys, misconfigured authentication, open database endpoints.
• High — Fix soon. Missing HSTS, no CSP, insecure cookies on session endpoints.
• Medium — Address when possible. Permissive CORS, missing secondary headers.
• Low — Informational. Minor configuration gaps that pose minimal direct risk.

Sharing your report

Every report has a unique, shareable URL. Share it with your team, embed it in a PR, or link it in a security review.