Vibe Risk Score
Aggregated security risk scoring for repositories, combining vulnerability, dependency health, AI code detection, license compliance, and supply chain signals into an A-F grade.
Overview
The Vibe Risk Score provides a single, aggregated risk grade (A through F) for each repository you scan. It combines seven distinct risk signals into a weighted overall score from 0 to 100, where higher scores indicate greater risk.
Unlike CVSS alone, Vibe Risk Score captures the full picture: vulnerabilities, dependency health, AI-generated code patterns, suspicious packages (slopsquatting), license compliance, install script risks, and code pattern findings.
Score Components
| Component | Weight | What It Measures |
|---|---|---|
| Vulnerabilities | 25% | Known CVEs weighted by severity (Critical x25, High x15, Medium x5, Low x1) |
| Dependency Health | 20% | Maintenance status, contributor count, update frequency of dependencies |
| AI-Generated Code | 15% | Detected AI code patterns: burst commits, boilerplate, excessive error handling |
| Code Patterns | 10% | Suspicious code patterns in dependencies (eval, dynamic requires, hardcoded secrets) |
| Slopsquatting | 10% | Packages that may be typosquats or AI-hallucinated dependencies |
| License Risk | 10% | Dependencies with incompatible or restrictive licenses |
| Install Scripts | 10% | Packages that run arbitrary code during installation (supply chain risk) |
Grade Scale
- A (0-20) — Excellent. Minimal risk across all dimensions.
- B (21-40) — Good. Minor issues that should be tracked.
- C (41-60) — Fair. Multiple risk signals detected. Review recommended.
- D (61-80) — Poor. Significant risk. Immediate attention needed.
- F (81-100) — Critical. Severe risk across multiple dimensions. Fix immediately.
AI Code Detection
The AI Code Detection component analyzes git commit patterns and source code to estimate the percentage of AI-generated code. See the dedicated AI Code Detection documentation for full details on signals, scoring, and policy configuration.
Key signals detected:
- Commit Bursts — Commits within 2 minutes of each other, typical of AI-generated code sessions
- Large Commits — Commits with 300+ lines changed, suggesting bulk AI code generation
- AI-Style Messages — Commit messages matching common AI patterns
- Boilerplate Comments — Comments like "This function..." or "Helper to..." typical of AI tools
- Excessive Error Handling — Over-generated try/catch blocks common in AI code
- High Comment Ratio — Files with >40% comment lines indicating AI over-documentation
AI Code Policy
Configure automated enforcement of AI code quality standards on pull requests. Navigate to Vibe Risk → AI Code Policy to set thresholds and actions:
- Max AI Percentage — Trigger when estimated AI-generated code exceeds a threshold (default: 70%)
- Max AI Risk Score — Trigger when the AI code risk score exceeds a threshold (default: 80)
- Warn — Add a warning comment and mark the check as "action required"
- Block — Fail the GitHub check run, preventing merge
Trend Tracking
Each repository shows a trend indicator (improving, stable, or worsening) based on comparison with the previous scan. This helps you track whether your remediation efforts are moving the needle.
Detail View
Click any repository card on the Vibe Risk dashboard to see a detailed breakdown: all seven score components with weights, an issue summary grid, prioritized improvement recommendations, and AI code best practices.