How to read a VibeLeak scan result
Decode the grade scale, severity labels, and finding categories so the scan result turns into an actionable fix list instead of a wall of noise.
Reading the result
The grade is a summary, not the whole story
S through F maps to a numerical range. The grade gives a headline, but the real value is in the per-category breakdown that shows where the points were lost.
Grade S
98–100
Exceptional. A clean scan with zero findings earns the full 100/100.
Grade A
90–97
Strong. Low or informational hygiene gaps only; any medium finding caps below A.
Grade B
75–89
Good with tuneups. A high or medium finding is present but not repeated enough to force C.
Grade C
55–74
Common gaps. Repeated medium gaps, repeated highs, or high plus two medium findings.
Grade D
35–54
Significant risk. One critical finding caps the score here.
Grade F
0–34
Critical action. Two critical findings, severe cumulative penalties, or a failed scan.
Findings
Each finding ties to a category and a remediation path
The findings are grouped by module: transport, headers, exposure, AI signals, and more. That grouping makes it easier to batch fixes by theme instead of jumping around.
- Transport findings cover HTTPS, TLS version, and certificate posture.
- Header findings list missing or weak security headers with specific recommendations.
- Exposure findings flag public files, configuration leaks, and obvious weak points.
- AI Signal findings measure how legible the site is to automated discovery and agents.
Severity
Critical, high, medium, low, and info each mean something different
Severity is based on trust impact, not theoretical exploitability. A missing header can be critical if it exposes a broad attack surface.
How to use severity
Context
Percentile rank tells you where the site sits relative to the corpus
A Grade B at the 85th percentile means the site is better than most, even if the grade is not perfect. Use percentile to calibrate expectations and communicate progress to stakeholders.
Practical use
Action
Fix in this order for the fastest trust improvement
The scan is designed so that fixing findings in severity order usually moves the grade the most. Here is the recommended sequence.
Fix critical transport issues
HTTPS enforcement and certificate problems are the foundation. Everything else is secondary.
Close high-severity header gaps
Missing CSP, framing controls, or HSTS are usually one-line fixes with large score impact.
Remove exposure findings
Public files and configuration leaks are easy wins that remove obvious attack paths.
Polish medium and low findings
These are refinements. Address them once the major gaps are closed.
Next action
Run the scanner against your own site
The article lands hardest when it turns into a fix list. Scan, close the gaps, and recheck.
Continue reading
More field notes
Workflow
Can Hermes Agent Audit a Live Website? Testing VibeLeak MCP End to End
Connect Hermes Agent to VibeLeak MCP, audit a live website, inspect the security boundary, and export agent-ready remediation evidence.
Open articleSecurity
GPT-5.6 Sol + Codex Security: Scan Outside, Fix Inside
Turn a VibeLeak public-surface scan into a structured security handoff for Codex Security and GPT-5.6 Sol to validate and patch.
Open articleWorkflow
AI agents are checking your website now. Here is the VibeSignal readiness checklist
Search is becoming conversational, agentic, and more selective about what it can understand. This is the practical checklist for making your public website easier for AI agents to find, read, use, and verify.
Open article