Stack health
One number for whether an app is in good shape: not just what is exploitable today, but how far behind it is drifting.
The score
Every app starts at 100 and loses points from four factors below, each capped so no single factor can sink the whole score on its own. The score is recomputed after every manifest upload, and a snapshot is kept once a day so a digest can show how it moved.
Grades
| Grade | Score | What it means |
|---|---|---|
| A | 90 to 100 | Nothing to fix today. Keep shipping. |
| B | 75 to 89 | In good shape, with a little to keep an eye on. |
| C | 55 to 74 | Worth a look this week. |
| D | 30 to 54 | Several things worth fixing soon. |
| E | 0 to 29 | Critical and fixable right now. Stop and fix this today. |
What moves it
Vulnerability severity
Open vulnerability alerts, weighted by severity and whether a fix exists. Exploited advisories weigh the most.
End of life and approaching end of life
A runtime past its end-of-life date costs the most; one approaching within six months costs less.
Version freshness
How many months behind the latest release your direct dependencies sit, on average.
Unresolved versions
Components where the version came from a range rather than a lockfile, so the match is a guess rather than a fact.
News and dev tooling do not count
Freshness
For each direct dependency, VibeBeacon checks the latest published version on its registry (npm, PyPI, crates.io, Go modules, RubyGems, Packagist) and works out how many months behind it you are, refreshed roughly once a day per component. A component more than 24 months behind is called out on the app page and on the fix plan.
Where you see it
- A badge on the app detail page, the dashboard cards, and the apps list.
- A “Lowest score” callout on the dashboard for any app graded D or E.
- A line in every digest: the current score and grade, how it changed since the last digest, and the top cause if it moved.
- An app with no manifest yet, or that is not active, shows “Not scored yet” rather than a number.
See also
The fix plan bands that drive most of the vulnerability factor are covered on Fixing an alert.