Rubric v1.0.0 · 2026-07-07 · superseded
The Veriify scoring rubric
Every point deducted from a Product Health Score traces back to a check defined here, with a fixed severity and deduction. No vibes, no black box. This is the same rubric the scanner runs against, versioned so results stay reproducible.
You are reading a
superseded version, kept exactly as published so any score citing it stays checkable.
See the current rubric.
Severity deductions
| Severity | Deduction (within its dimension) |
|---|
| critical | −30 pts |
| high | −12 pts |
| medium | −5 pts |
| low | −2 pts |
Dimension weights by category
Green = weighted higher than the General baseline. Pick a category on the scanner and the composite re-weights to match.
| Dimension | default | ecommerce | saas | content | portfolio |
|---|
| Functional Correctness | 25% | 28% | 26% | 18% | 20% |
| Reliability & Stability | 15% | 14% | 17% | 12% | 10% |
| Performance | 12% | 10% | 10% | 18% | 18% |
| Security | 15% | 20% | 18% | 12% | 12% |
| UX & Accessibility | 12% | 12% | 11% | 14% | 18% |
| Content & Communication | 8% | 5% | 6% | 16% | 14% |
| Code & Architecture Quality | 8% | 4% | 7% | 4% | 4% |
| Compliance & Trust | 5% | 7% | 5% | 6% | 4% |
All checks by dimension
Functional Correctness 12 checks
| Check | Title | Severity | Cap | What it means |
|---|
| FUNC-001 |
Broken internal link |
high |
48 |
An internal link returns a 4xx/5xx status or fails to resolve. |
| FUNC-002 |
Broken image |
medium |
25 |
An image resource fails to load (4xx/5xx or network error). |
| FUNC-003 |
Form without a submission target |
medium |
15 |
A <form> has no action and no obvious JS handler hint, risking dead submissions. |
| FUNC-004 |
Broken outbound link |
low |
10 |
An external link returns a 4xx/5xx status. |
| FUNC-005 |
Key page failing |
critical |
60 |
A discovered page of the product itself returns a server error or fails to load. |
| FUNC-006 |
Broken script or stylesheet |
medium |
15 |
A referenced JS/CSS asset fails to load, likely breaking behavior or layout. |
| RUN-001 |
Uncaught JavaScript error |
critical |
60 |
An unhandled JS exception was thrown while the page ran in a real browser, likely breaking behaviour. |
| RUN-002 |
Console error |
medium |
20 |
The page logged an error to the browser console at runtime. |
| RUN-003 |
Content-Security-Policy blocked a resource |
high |
36 |
A script, style, or connection was blocked by the CSP at runtime, so a feature failed to load or work. |
| RUN-004 |
Runtime resource failed to load |
medium |
25 |
A subresource request failed or returned an error while the page was running (broken script/style/image/API). |
| RUN-005 |
Key content failed to render |
high |
36 |
A primary content area rendered empty in a real browser — the page loads over HTTP but is broken at runtime. |
| RUN-006 |
Interactive element throws on use |
high |
24 |
Clicking a primary control raised a JavaScript error instead of doing something. |
Reliability & Stability 4 checks
| Check | Title | Severity | Cap | What it means |
|---|
| REL-001 |
Server errors observed |
critical |
60 |
One or more requests returned a 5xx during the scan. |
| REL-002 |
Inconsistent responses |
high |
24 |
Repeated identical requests returned different statuses or wildly different payloads (flakiness). |
| REL-003 |
Soft-404 / missing not-found handling |
medium |
5 |
A clearly non-existent path returns 200 OK instead of a proper 404 page. |
| REL-004 |
High response-time variance |
low |
6 |
Repeated requests show large latency swings, indicating instability under light load. |
Performance 6 checks
| Check | Title | Severity | Cap | What it means |
|---|
| PERF-001 |
Slow server response (TTFB) |
high |
24 |
Time to first byte exceeds acceptable bands (>1.2s high, >2.5s critical band). |
| PERF-002 |
Heavy page weight |
medium |
15 |
Total transferred bytes for the page exceed 3 MB (medium) / 6 MB (high). |
| PERF-003 |
Missing text compression |
medium |
10 |
HTML/CSS/JS served without gzip/brotli compression. |
| PERF-004 |
Missing cache headers on static assets |
low |
8 |
Static assets served without Cache-Control/ETag, forcing refetches. |
| PERF-005 |
Oversized image |
medium |
15 |
A single image exceeds 500 KB as delivered. |
| PERF-006 |
Excessive request count |
low |
6 |
A page requires more than 80 subresource requests. |
Security 12 checks
| Check | Title | Severity | Cap | What it means |
|---|
| SEC-001 |
No HTTPS enforcement |
critical |
30 |
Site is served over plain HTTP or does not redirect HTTP→HTTPS. |
| SEC-002 |
Missing HSTS header |
medium |
5 |
Strict-Transport-Security header absent on HTTPS responses. |
| SEC-003 |
Missing Content-Security-Policy |
medium |
5 |
No CSP header, increasing XSS blast radius. |
| SEC-004 |
Missing X-Content-Type-Options |
low |
2 |
nosniff header absent; MIME-sniffing attacks possible. |
| SEC-005 |
Clickjacking protection missing |
medium |
5 |
Neither X-Frame-Options nor frame-ancestors CSP directive present. |
| SEC-006 |
Insecure cookie flags |
high |
24 |
Session/identifying cookies set without Secure and/or HttpOnly. |
| SEC-007 |
Sensitive file exposed |
critical |
60 |
A sensitive file (.env, .git/config, backup) is publicly downloadable. Only probed with verified ownership. |
| SEC-008 |
Dangerous CORS configuration |
high |
12 |
Access-Control-Allow-Origin: * combined with credentials, or reflective origin allow-listing. |
| SEC-009 |
Server version disclosure |
low |
2 |
Server/X-Powered-By headers leak exact software versions. |
| SEC-010 |
Mixed content |
high |
24 |
HTTPS page loads scripts/styles/images over plain HTTP. |
| SEC-011 |
Missing Referrer-Policy |
low |
2 |
No Referrer-Policy header; full URLs may leak to third parties. |
| SEC-012 |
Missing Permissions-Policy |
low |
2 |
No Permissions-Policy header limiting powerful browser features. |
UX & Accessibility 7 checks
| Check | Title | Severity | Cap | What it means |
|---|
| UXA-001 |
Image missing alt text |
medium |
20 |
Meaningful <img> without an alt attribute (WCAG 1.1.1). |
| UXA-002 |
Form input without label |
medium |
20 |
Input/select/textarea lacks an associated label, aria-label, or aria-labelledby (WCAG 3.3.2). |
| UXA-003 |
Missing page language |
low |
2 |
<html> element has no lang attribute (WCAG 3.1.1). |
| UXA-004 |
Not mobile-ready |
high |
12 |
No viewport meta tag; page will render desktop-sized on mobile. |
| UXA-005 |
Broken heading hierarchy |
low |
6 |
Missing h1, multiple h1s, or skipped heading levels harming navigation for assistive tech. |
| UXA-006 |
Link without discernible text |
medium |
15 |
Anchor has no text, aria-label, or title — screen readers announce nothing (WCAG 2.4.4). |
| UXA-007 |
Duplicate element IDs |
low |
4 |
Duplicate id attributes break ARIA references and label associations (WCAG 4.1.1). |
Content & Communication 7 checks
| Check | Title | Severity | Cap | What it means |
|---|
| CON-001 |
Placeholder content live |
high |
36 |
Generic filler/dummy copy, leftover developer markers, or under-construction notices visible on a production page. |
| CON-002 |
Missing page title |
high |
12 |
Page has no <title>, hurting SEO and tab usability. |
| CON-003 |
Missing meta description |
medium |
10 |
No meta description; search snippets will be auto-generated. |
| CON-004 |
Duplicate page titles |
low |
4 |
Multiple pages share the same <title>, confusing users and search engines. |
| CON-005 |
Thin page content |
low |
6 |
Page has under ~40 words of body text. |
| CON-006 |
Missing favicon |
low |
2 |
No favicon defined or the referenced favicon fails to load. |
| CON-007 |
Missing social preview tags |
low |
2 |
No Open Graph / Twitter card tags; shared links render poorly. |
Code & Architecture Quality 6 checks
| Check | Title | Severity | Cap | What it means |
|---|
| CODE-001 |
Lint violations |
medium |
25 |
Static-analysis violations in connected repository (repo mode). |
| CODE-002 |
Secrets committed to repository |
high |
36 |
API keys/credentials detected in repo history or files (repo mode). |
| CODE-003 |
No automated tests detected |
medium |
20 |
Repository has no test files or test runner configuration (repo mode). |
| CODE-004 |
Unresolved merge-conflict markers |
high |
30 |
Git conflict markers (<<<<<<<, =======, >>>>>>>) left in committed files (repo mode). |
| CODE-005 |
Debug statements left in code |
low |
8 |
Leftover debug output (console.log, debugger, print, var_dump) shipped in source (repo mode). |
| CODE-006 |
No linter configuration |
low |
6 |
No linter/formatter config detected (eslint, ruff, rubocop, etc.) — style is unenforced (repo mode). |
Compliance & Trust 4 checks
| Check | Title | Severity | Cap | What it means |
|---|
| CMP-001 |
No privacy policy found |
high |
12 |
No discoverable privacy policy link. (Signal, not legal advice.) |
| CMP-002 |
No terms of service found |
medium |
5 |
No discoverable terms/conditions link. (Signal, not legal advice.) |
| CMP-003 |
No contact information |
medium |
5 |
No contact page, mailto link, or contact details discoverable. |
| CMP-004 |
Cookies without consent signal |
low |
2 |
Site sets non-essential-looking cookies with no detectable consent mechanism. (Signal, not legal advice.) |
Prefer machine-readable? The same rubric is served as JSON at
/api/rubric.