How We Grade Your Security

Full transparency on how Sentinel calculates your security grade. 7 categories, severity-weighted deductions, hard caps for critical issues, performance bonuses, and no hidden weights.

The Scoring Formula

Every scan starts at 100 points. Points are deducted based on the severity of findings discovered, then bonuses are added. The final score maps to a letter grade.

Score=100—Critical×25—High×8—Medium×3—Low×1+Bonuses(max+4)

Severity Point Deductions

-25
Critical
Active exploitation likely. Immediate risk of data breach, system compromise, or service takeover.
-8
High
Significant vulnerability that could lead to unauthorized access, data exposure, or privilege escalation.
-3
Medium
Moderate risk: misconfiguration or missing control that weakens overall security posture.
-1
Low
Minor issue: informational finding or best-practice gap with limited direct exploitability.

Hard Caps — No Bonus Can Bypass

  • A single Critical finding forces an automatic F grade.
  • Cloaking or ghost-page detection forces an automatic F grade.
  • Unassessed core checks cap the maximum grade at C.
  • Maximum score is 99. No scan can achieve a perfect 100.

Interactive Score Calculator

Toggle findings below to see how each severity affects your grade in real time.

Load a real scan
Critical
−25 pts
0
High
−8 pts
1
Medium
−3 pts
2
Low
−1 pts
1

Performance Bonuses+0 / 4

Live Result4 findings
85/99
B
100− 15 deductions
+ bonuses+ 0
Final Score85
05099

Grade Scale (A+ to F)

A+
95–99
Score 95–99 with at least 2 bonuses and zero medium/high/critical findings.
A
88–94
Score 88–99. Strong security with no critical issues.
B
78–87
Score 78–87. Good, with a few minor gaps to address.
C
65–77
Score 65–77. Acceptable; several issues worth fixing.
D
50–64
Score 50–64. Weak; multiple meaningful issues present.
F
0–49
Score below 50, or any critical finding or cloaking detected.

Performance Bonuses

Each qualifying bonus adds +1 point (max +4) to the final score. Bonuses require observed evidence.

HSTS Preload+1

Strict-Transport-Security header with preload directive forces all traffic to HTTPS.

Strict CSP+1

Content-Security-Policy using strict-dynamic or a cryptographic nonce for scripts.

WAF Detected+1

A dedicated Web Application Firewall is protecting the origin.

Rate Limiting+1

API endpoints and forms rate-limit requests to prevent abuse.

Note: A blocked/rate-limited scanner never earns bonuses. Coverage must be authoritative and complete.

7 Evidence Surfaces

Results are organized into seven core categories that cover the full attack surface of a modern web application.

01

Secrets & Credentials

Exposed API keys, database credentials, .env files, and source maps.

  • Hardcoded tokens in JavaScript bundles
  • Exposed .env and config files
  • Source map leakage
  • Cloud service credentials
02

Browser Security Controls

CSP, HSTS, X-Frame-Options, cookies, and CORS configuration.

  • Content-Security-Policy analysis
  • HSTS preload eligibility
  • Cookie security flags (Secure, HttpOnly, SameSite)
  • CORS origin validation
03

SSL/TLS Configuration

Certificate validity, protocol support, and cipher strength.

  • Certificate chain and expiry
  • TLS protocol version support
  • Cipher suite strength analysis
  • OCSP stapling and revocation
04

Authentication & APIs

Open API routes, anonymous data access, and authorization gaps.

  • Exposed API endpoints without auth
  • Open redirect detection
  • Rate limiting presence
  • CORS misconfiguration
05

DNS & Email Security

SPF, DKIM, DMARC, DNSSEC, and domain misconfigurations.

  • SPF record presence and strictness
  • DKIM signing verification
  • DMARC policy analysis
  • DNSSEC validation status
06

Database & Storage Exposure

Supabase/Firebase access, sensitive files, and cloud storage buckets.

  • Supabase anon key exposure
  • Firebase open database rules
  • Public cloud storage buckets
  • Unsecured S3/R2 buckets
07

Dependencies & CVEs

Version-linked vulnerabilities backed by NVD and OSV data.

  • Known CVE matching via header fingerprinting
  • Outdated library detection
  • Vulnerable dependency alerts
  • NVD sync for emerging threats

Coverage & Authorization

A grade is only issued when effective coverage meets the minimum threshold.

Official Score
At least 80% effective coverage with every core security surface completed.
Partial Result
50–80% coverage. Numeric score shown but no letter grade or badge issued.
Insufficient
Below 50% coverage. No numeric score; confirmed findings remain visible.

Methodology Version History

v1.3July 2026

Introduced A+ grade with stricter bonus requirements. Added coverage classification system. Refined bonus evidence rules.

v1.2April 2026

Added 7th category (Dependencies & CVEs) with NVD/OSV integration. Introduced rate limiting and WAF detection bonuses.

v1.1January 2026

Rebalanced severity weights: High from −10 to −8, Medium from −5 to −3.

v1.0October 2025

Initial methodology release. 6 categories, 100-base scoring, severity multipliers, and bonus system.

Our Scoring Pledge

We believe security scoring should be transparent, not a black box. Here is what we commit to:

  • No hidden weights — the exact formula is published for everyone to see.
  • No brand exemptions — a known platform and an unknown domain receive identical scores for identical findings.
  • Platform context is used strictly to improve remediation guidance, never to alter score math or severity weights.
How We Grade Your Security — Sentinel Scoring Methodology | Sentinel Scanner