Skip to content
How it worksFree ToolsVuln DBPricingBlogContactLog in

How Vezraa Scores Your App's Security

Vezraa is a read-only production-readiness scan. We fetch your public pages, headers, HTML, JavaScript bundles, DNS records, and probe public route responses. We never modify your app or store credentials.

Scoring formula

Each category starts at 100. Findings deduct weighted points: critical = 25, high = 15, medium = 8, low = 3. The overall score is a weighted average across the categories below. Categories that don't apply to your stack (no AI provider, no payments) are excluded from the average.

Severity levels

  • CRITICAL — Exposes credentials, customer data, admin access, or payment risk
  • HIGH — Exploitable misconfigurations or significant trust gaps
  • MEDIUM — Reduces resilience or user trust
  • LOW — Cleanup and polish items

Categories & weights

Security
Exposed secrets, missing headers, RLS, CORS, auth flows
25%
Performance
LCP, TBT, CLS, bundle size, caching, compression
15%
Payments
Webhook verification, key exposure, idempotency
10%
SEO
Meta tags, OG, canonical, sitemap, robots, schema
10%
Observability
Error tracking, analytics, console PII
8%
AI
Rate limiting, prompt injection, token limits, cost guards
8%
Accessibility
Score, alt text, labels, lang, landmarks, focus
7%
Email
SPF, DKIM, DMARC, MX records
6%
Legal
Privacy policy, terms, cookie consent, contact
6%
Infrastructure
Debug mode, console.log, 404, mixed content
5%
Breach
Domain breach history, email compromise
—

Data retention

Raw scan artifacts (HTML, headers, bundles) are retained for up to 90 days to support report viewing, diffs, and support requests. Findings and scores persist for 1 year on free accounts and for the duration of the subscription on paid accounts. You can request deletion at any time at udayakirantumma@gmail.com.

What we never do

  • · We never ask for your credentials or tokens
  • · We never modify your app, database, or files
  • · We never share your URL or findings with anyone
  • · We never store your raw HTML beyond 30 days
Methodology — How Vezraa Scores Your App | Vezraa