Security Scoring

Inkog uses a consistent scoring system to help you understand the severity of findings and prioritize remediation.

Severity Levels

Each finding is assigned one of four severity levels:

Security Grades

Your findings determine your security grade:

HTML Report Grades

The HTML output includes a visual grade badge:

┌─────────────────────────────┐
│    SECURITY GRADE           │
│                             │
│         ┌───┐               │
│         │ B │               │
│         └───┘               │
│                             │
│    Status: PASSED           │
└─────────────────────────────┘

Interpreting Results

Clean Scan (Grade A)

✓ Security scan complete
  Grade: A
  Findings: 0

Action: No immediate action needed. Consider periodic rescanning.

Minor Issues (Grade B)

⚠ Security scan complete
  Grade: B
  Findings: 3 low

Action: Address low-severity findings during regular maintenance.

Moderate Issues (Grade C)

⚠ Security scan complete
  Grade: C
  Findings: 1 high, 2 medium

Action: Prioritize high findings, schedule medium findings.

Serious Issues (Grade D/F)

✗ Security scan complete
  Grade: F
  Findings: 2 critical, 3 high

Action: Stop deployment. Address critical findings immediately.

Severity Filtering

Control which severities you want to see:

# Only show critical
inkog -severity critical .
 
# Show high and above (recommended for CI/CD)
inkog -severity high .
 
# Show all findings
inkog -severity low .

See Security Gates for CI/CD configuration.

Confidence Calibration

Every finding includes a confidence score (0-1) indicating how likely it is to be a true positive. Inkog uses self-learning Bayesian calibration to improve these scores over time.

How It Works

1. Base Confidence: Each detection rule has an initial confidence from our testing
2. User Feedback: When you mark findings as true/false positives via the Feedback API, the system learns
3. Calibrated Confidence: The adjusted score reflects real-world accuracy

Interpreting Confidence

Calibration Reliability

The calibration reliability indicates how trustworthy the calibrated score is: