SniffPupHow the Sniff score works
A high score means no issues were found in the checks we run, not that the app is secure.
Every SniffPup scan, free or paid, shows a Sniff score from 0 to 100. It comes straight from the severity of each finding, which every report shows, so the score is the same whether or not you buy the full report. There are no letter grades.
The method
- Start at 100.
- For every finding, subtract the points for its severity (table below). Each finding counts, so two high findings subtract 40.
- Info findings, such as a note that your site uses Supabase, subtract nothing.
- Clamp the result to 0–100. A score can't go below 0.
| Severity | Points subtracted per finding |
|---|---|
| critical | 40 |
| high | 20 |
| medium | 8 |
| low | 3 |
| info | 0 |
As a formula: score = max(0, 100 − (40 × critical + 20 × high + 8 × medium + 3 × low)).
Examples
| Findings | Score |
|---|---|
| No findings | 100 |
| Only info notes (e.g. “this site uses Supabase”) | 100 |
| 1 medium + 2 low | 86 |
| 1 high + 1 medium | 72 |
| 1 critical + 1 high + 1 low | 37 |
| 3 critical | 0 |
What the score doesn't tell you
The score only reflects the passive checks SniffPup runs against your live site: what any visitor can see, like leaked keys in your JavaScript, public files, a public source map, security headers and cookie flags (plus, on a Pro deep check, which Supabase tables an anonymous visitor can read and which buckets are public). It can't see your source code, server logic, database policies or anything behind a login. A score of 100 means Ember didn't find any issues in those checks (info notes don't count). It is not a guarantee.