Reading your report
What does my score mean?
The score is out of 100. Good is 85 or more with no critical finding and no waiting or unfinished checks. Fair is 60 to 84, and Poor is below 60.
One critical finding makes the band Critical, whatever the score.
What does Partial mean?
A Partial report would score 85 or more with no critical finding, but some checks are waiting or did not finish. It shows N/A and Not evaluated in place of the score.
What does Waiting mean?
Waiting is not a fault. It marks a check that goes beyond what a browser loads and runs once the domain is confirmed. For an app on Free, the daily check leaves those checks out until then.
Click Run a check to run them now, or confirm the domain.
What does Not checked mean?
Not checked marks a check that needs access to your code, which comes with a plan, so it did not run. A report never counts such a check as passed.
Connect the repository behind an app on Watch or Care and the code checks run.
What does Not run mean?
Not run means the check did not finish. A check that asks a service that did not answer is asked once more before it counts as not run.
What it confirmed before it stopped stays in the report, and the next check asks again.
What does Possible mean?
Possible means a finding in your code could not be confirmed as reachable. It stays in your report so you can look.
Check that the file we name is still deployed before you act on it. Old files you no longer deploy can raise it too.
What if a finding is wrong?
It can be. On real code, most raw alerts from a first look are wrong. Language models therefore read the findings of the checks that follow a request or a rule through your code, and what they reject is left out. The review does not catch everything.
If a finding does not apply, open it, click Tell us it is not an issue and say why. When we agree, we mark it Not an issue, and it keeps that mark on later checks.
My report has no findings. Is my app secure?
It means no finding was detected in the completed checks. That does not rule out other vulnerabilities.
The checks never look at pages and APIs behind a sign-in, your business rules, your live cloud account, or the build of a mobile or desktop app. Vallit sends no attacks and runs no penetration test.