A single number hides things. Ours states what it is made of, drops to a partial result when a stage fails, and refuses to produce a score at all when it cannot stand behind one.
A single number is a compression of a lot of detail, and compression loses things. The question for any score is which things it chose to lose, and whether it tells you.
We wanted a number because the alternative — a table of severities — is exactly the artifact our users already ignore. But a number that cannot be interrogated is just a mood, so ours has three rules attached to it.
It states what it is made of
The score is not a verdict handed down. Next to it is the breakdown: how much came from severity, how much from how reachable a finding actually is, and how much of the score is affected by checks we could not run at all. If your score is low because of one critical finding, that is visible. If it is low because half the checks had no evidence, that is visible too, and it is a completely different problem with a completely different fix.
It refuses to exist when it cannot be trusted
If a scan stage fails, the scan finishes as a partial result. You still get every finding the stages that ran produced — withholding those would be indefensible. What you do not get is a score, because a score computed from four of five passes is not a lower score, it is a differently-shaped one, and presenting it as comparable would be a lie by arithmetic.
A partial scan is also excluded from your score history rather than plotted low, and it cannot be shared. A gap in the line is a scan that could not finish, and it is labelled as one.
It carries its own provenance
Every score is stamped with the rule pack version, the sandbox image, and the date of the vulnerability database that produced it. This matters more than it sounds: the rules ship weekly, and without those stamps a score that moved between two scans could mean your code changed or could mean we started checking something new. With them, you can tell which.
What it will never say
Not “secure”. Not “production ready”. A clean report means no issues were found in the checks we ran, and the share card says exactly that — along with the date, the rule pack version, and whether any findings were dismissed. The moment a badge is worth something, it is worth faking, and the only defence against that is a badge that does not overclaim in the first place.