Scoring explained
Every flow in a scan gets a risk score from 0 to 100 and an action level derived from it. The score comes only from that flow’s own findings.
The formula
RawScore = sum of base points across the flow's findings
CategoryMultiplier = highest category multiplier among those findings
EnvironmentMultiplier = multiplier for the environment type
FinalScore = min(RawScore × CategoryMultiplier × EnvironmentMultiplier, 100)Base points
| Severity | Base points |
|---|---|
| Critical | 25 |
| High | 10 |
| Medium | 4 |
| Low | 1 |
| Informational | 0 |
Category multipliers
| Category | Multiplier |
|---|---|
| Exfiltration | 2.0 |
| Security | 1.5 |
| AI | 1.3 |
| Governance | 1.0 |
| Operational | 1.0 |
| Compliance | 1.0 |
The category multiplier is a maximum, not a sum. One Exfiltration finding lifts the whole flow to 2.0; ten Governance findings still multiply by 1.0.
Environment multipliers
| Environment type | Multiplier |
|---|---|
| Default | 1.5 |
| Production | 1.0 |
| Sandbox | 0.8 |
In 1.2.0 the scan does not discover environment types, so every flow is scored with the Default multiplier (1.5) regardless of where it lives. The Production and Sandbox rows describe the model, not current behavior. See Known limitations in 1.2.0.
Action levels
| Score | Action level |
|---|---|
| 80–100 | Immediate Action (24h SLA) |
| 50–79 | Review Within 7 Days |
| 20–49 | Monitor (monthly review) |
| Below 20 | Acceptable |
Worked example
A Production flow has two findings: SEC-01 Hardcoded Secret (Critical, 25 points) and EXF-03 HTTP Exfiltration Risk (High, 10 points).
- RawScore: 25 + 10 = 35
- CategoryMultiplier: max(Security 1.5, Exfiltration 2.0) = 2.0
- EnvironmentMultiplier: Production = 1.0
- FinalScore: 35 × 2.0 × 1.0 = 70 → Review Within 7 Days
The same two findings in the Default environment: 35 × 2.0 × 1.5 = 105, capped at 100 → Immediate Action (24h SLA). In 1.2.0 every flow gets this second calculation, because all flows are treated as Default.
The same findings can land in different bands purely because of where the flow lives, which is also what HYG-02 flags.
Tuning the model
Severity overrides change a finding’s severity and therefore its base points. The model itself is configurable under the Scoring section of appsettings.json next to the executable: CriticalBase, HighBase, MediumBase, LowBase, CategoryMultipliers, and EnvironmentMultiplier. Restart the app to apply.
Last updated: July 27, 2026