Report and scoring

• Score and grade. Each area scores 0–100 from the severity of its findings; info findings never lower a score. The overall score is the average of the areas that were actually examined. Skipped auditors are listed with the reason, so a clean result never hides a check that didn't run.
• Interactive HTML. One self-contained file with no external requests, so it opens offline and can be attached to a CI run or an email. It has an overview, a tab per area with filters and search, an auditors tab, and OWASP Top 10 / CWE Top 25 groupings. It works with JavaScript off, prints cleanly, and lets readers download the same audit as JSON, SARIF, Markdown or CSV. Shared reports name the project folder, never your local path.
• Stable fingerprints. Each finding has a fingerprint that baselines, suppressions and compare_reports rely on.
• Diff mode. --diff origin/main keeps only findings in files changed since that ref, for pull requests.

See one: openaudit's audit of its own repository, rebuilt on every push.

Scoring

Each finding adds a penalty by severity, and an area's score decays as the penalty grows, so the first serious finding costs the most. Info findings never lower a score. The overall score is the average of the areas that were examined. These examples are computed by openaudit's own scoring code when the site is built:

Grades

1. A90–100
2. B80–89
3. C70–79
4. D50–69
5. F0–49

Severity

Severity reflects real impact. Each level has its own colour and glyph in the report, so colour is never the only signal.

Critical

Directly exploitable or data-exposing issues.

High

Serious weaknesses.

Medium

Real problems that need a condition.

Low

Hardening and hygiene.

Info

Inventory that never lowers a score.

What it audits

Every finding belongs to one of ten areas, and each area gets its own score and grade.