← Back

Methodology MV-2026.3

Every check we run, the most severe thing it can raise, and whether it appears in the free preview. A grade you cannot argue with is not worth showing a buyer, so this is public and versioned. Certificates cite the version that produced them.

107 checks. 19 severity rules. Findings come from tools and analysis; every number comes from a published formula.

Version history

Every version that has been in force, newest first. A certificate cites the version that produced it, so this is how a buyer holding an older one can tell whether the ruler has moved since.

  1. MV-2026.3in force from 8 August 2026Changes grades

    Keys a provider publishes on purpose, such as a Stripe publishable key or a Supabase anon token, report as info rather than as leaked credentials.

    • AddedA `publishable` credential state, and rule SR-02C, which scores it info. A secret scanner matches shape, so it cannot tell a Stripe publishable key from a secret one, and it reports a Supabase anon token as loudly as a service_role token. Every such value is compiled into the app by design and is already readable by anyone who installs it, so there is nothing to leak and nothing to rotate. Previously they landed at high under SR-03, which put several rows saying "rotate this" beside any finding that was real. The state is asserted only from the value's own shape, never from a variable name: a service_role key behind a NEXT_PUBLIC_ prefix stays a credential exposure, because the prefix means it is compiled into the bundle. Grades can therefore rise for repositories that ship a client, most visibly mobile apps; certificates issued under MV-2026.2 keep the severities that version produced.
  2. MV-2026.2in force from 7 August 2026Changes grades

    Secret findings whose only citation is test or unreachable code report as medium rather than high.

    • ChangedSR-03, which treats an unverifiable credential as live, now applies only where the code is reachable in production. Previously it matched everywhere and shadowed SR-11, so a credential-shaped fixture in a test file scored the same as a key in production source. SR-11 already covers the test case at medium, and SR-02 still rates a credential that verifies as live critical wherever it sits. Grades can therefore rise for repositories carrying secret findings in test code; certificates issued under MV-2026.1 keep the severities that version produced.
  3. MV-2026.1in force from 6 August 2026No effect on grades

    First published version.

    • AddedNine scored dimensions with public weights, the deduction table, the repeat-decay curve, the per-check caps, and the grade bands.
    • AddedThe check catalog: what each check looks at, the most severe thing it is allowed to raise, and whether it appears in the free preview.
    • AddedThe severity rubric. Findings carry facets, the rubric turns facets into a severity, and the check's ceiling applies last. No model assigns a severity.

Inventory and architecturenot graded

What you are actually buying

Claims and functionality25% of the grade

Do the advertised features actually exist in the code

Security20% of the grade

Can someone reach data or money they should not

Billing integrity10% of the grade

Does the paywall actually hold

Only assessed when the product has billing code. When it does not apply, the remaining dimensions carry the grade instead.

Code quality and maintainability10% of the grade

How hard will this be to work on

Tests and CI10% of the grade

Can you change it without breaking it

Dependencies, licensing and IP10% of the grade

Can this be sold and kept running

Operability and transferability10% of the grade

Can a new owner run it without the founder

Provenance and bus factor5% of the grade

Where did this code come from

AI and LLM economics8% of the grade

Do the AI features have a viable cost structure

Only assessed when the product has llm usage. When it does not apply, the remaining dimensions carry the grade instead.