Reference

Grades and checks

Two things on every box that look alike and aren’t.

The short answer

Writing a test won’t change a grade. A test proves what your code already does; it doesn’t change your code.

Grades

Every box carries a letter from A to F. That letter is a grade: how the code in the box measures against the requirements of OWASP ASVS 5.0.0, the published standard we work from. We get it by reading the code, each time we scan.

Because it comes from reading, a grade changes only when the code changes. Change the code, push it, and the next scan reads it again.

Checks

A check is a test that runs against your app and either passes or doesn’t. Named means the file exists. Passing means we watched it run and pass.

A worked example

/checkoutB

A page, graded B. Its dashed edge: nothing tests the page on its own yet.

The line is the page calling the route. Solid: we watched that call run and pass.

/api/billingC

A route, graded C. Its dashed edge: a route on its own gets no file yet, unless it’s a webhook.

One passing check, on the line between two dashed boxes, and the route is still a C. A connection can be proved when neither end is. The line and the edges are checks; the letters are grades. Neither moves the other.

A correction

What people expectMy grade went up because I merged a test.

What happensIt didn’t. If a letter moved after a merge, something else in that pull request changed the code, and the next scan read it. The test only watched.