Rating methodology
VibefyCode Rubric v1.1.0 · checksum 16df419ffb252ed5…
Seven new criteria, and nothing else. No weight, penalty, confidence multiplier, band, gate, threshold or dimension floor differs from 1.0.0, so an application with identical findings scores identically under both — the pass mark has not moved. What is new is that seven things we can already observe now have somewhere to be recorded, instead of being reported as observations against a criterion that did not quite fit. SEC-12 and SEC-13 and PRI-07 exist because the verification page now answers a visitor directly and three of its questions had no criterion behind them. UX-07 gives visual consistency a home; findings against it are observations and carry no penalty, because tightening what a badge requires is a separate decision from having somewhere to write something down. FI-08, PRD-06 and STR-08 are for games, which fail in ways the general criteria were not written to look at. Every criterion here arrived with the check that answers it. A criterion nothing checks is worse than no criterion at all: it turns "nobody looked" into "nothing was found".
Dimensions and weights
| Dimension | Weight | What it asks |
|---|---|---|
| Functional integrity | 25% | Do the core flows actually complete, and does the app behave when they do not? |
| Security posture | 25% | What is observably exposed, and does authorisation hold on the server? |
| Data & privacy practice | 15% | What is collected, is it disclosed, and can a user get out? |
| Practicality & UX | 15% | Can a first-time user get to value, on the device they actually own? |
| Production readiness | 10% | Would this survive contact with real traffic and a bad day? |
| Store & distribution readiness | 10% | Would this pass the published submission requirements on first attempt? |
How a score is computed
Each dimension starts at 100. Every published finding subtracts its severity penalty, scaled by the confidence multiplier. Dimension scores are clamped to 0–100 and combined by weight. Gates are applied last and can only lower a result.
- Severity penalties
- critical −45 · high −22 · medium −9 · low −3 · info −0
- Confidence multipliers
- high ×1 · medium ×0.7 · low ×0.4
Gates
Gates are applied after the arithmetic and can only lower a result. No combination of strong dimensions outvotes them.
Critical security or privacy finding
A single critical exposure makes the rest of the score irrelevant. Encoded as a gate rather than as arithmetic so that no combination of strong dimensions can outvote it.
Caps the overall score at 49. Blocks certification.
Live credential exposed in client code or repository
The most common serious defect in AI-built apps, and the one with the fastest path to real-world harm.
Caps the overall score at 39. Blocks certification.
Core flows unreachable within the authorised scope
If the authorised scope did not permit exercising the core flows, we did not assess the product and must not certify it.
Blocks certification.
Certification threshold
A badge issues only when the overall score reaches 70, every dimension floor is met, no gate has fired, and a human reviewer has approved the assessment. Badges expire within 12 months at the outside.
- security posture — minimum 65
- data privacy practice — minimum 60
- functional integrity — minimum 60
Independence
Payment buys depth, re-testing, monitoring and support. Payment never buys a score. The scoring function receives a data structure that has no field for a plan, a price or a marketing relationship, and a test in our build pipeline constructs a maximally-paying customer and a free customer with identical apps and asserts that their scores are identical. Reviewer overrides are recorded with a written reason and cannot be edited.
