Methodology

How a score is built, and what it cannot tell you.

A number nobody can reconstruct is not evidence. These are the weights, the decay and the bands, written so you can disagree with a specific part of them.

Calibrated once, trusted for the whole run.

What is measured

Four deterministic checkers read one input and return findings, metrics and a count of the rules that ran. Nothing is inferred by a model, nothing leaves the browser, and the same input produces the same report whenever it is run.

Metrics are measurements, not faults: line counts, reading ease, bytes per pixel, checksum presence. They appear beside the findings so a reviewer can see the evidence rather than only a verdict.

How the score is calculated

The score starts at 100. Each finding deducts its severity weight, multiplied by a decay factor of 0.72 raised to the finding's position when sorted by severity. The result is rounded and floored at zero.

The decay exists for one reason: without it, a file with six medium findings scores the same as one with a leaked key. With it, the most serious finding takes the largest bite, and a long tail of small ones still registers.

  • Critical−22

    Something that must not ship: a credential in source, unparseable data, an image that cannot be decoded.

  • High−12

    A defect with a realistic path to harm or visible failure: an execution sink, a swallowed error, a broken outline.

  • Medium−6

    Quality and consistency problems that erode trust or cost later work: placeholders, dead links, flat rhythm.

  • Low−2.5

    Measured observations rather than faults: line length, adverb density, duplication.

Bands and verdicts

The grade and the plain-language verdict are both derived from the score. They are deliberately conservative: the top band is described as ready to publish rather than good.

  • 90–100APublish-ready
  • 80–89BShips with small fixes
  • 70–79CFix before publishing
  • 60–69DFix before publishing
  • 55–59DNot ready to ship
  • 0–54FNot ready to ship

The limits, stated plainly

  • It does not detect who or what wrote the work. Authorship detection is unreliable and is not offered.
  • It does not judge whether a claim is true in the world, only whether it is sourced and phrased responsibly.
  • It does not run your code. Static reading finds structure and patterns, not behaviour.
  • Image findings come from the decoded pixels and embedded metadata of the file you supply.
  • Reports are capped at the 24 highest-severity findings, and text input is read to 200,000 characters.

Why human review is a different instrument

A reviewer is not a better checker. A reviewer answers questions the rules cannot: whether the argument holds, whether the audience is right, whether a likeness is acceptable. Their output is a decision with a stated scope and a name, and it costs hours rather than milliseconds.

The two are meant to run in sequence. Automated findings clear the mechanical questions so the review starts at the part that needs a person.

See it applied

One file, one score, every finding named.

The report shows the findings behind the number, so the arithmetic is checkable rather than trusted.