Evidence your team can inspect and act on.

A V2P result is more than an overall score. It connects weighted rubric outcomes to source locations, findings, context, and controlled next actions.

Start an audit See the complete program

From observation to decision

Observed source patternA relevant file, excerpt, and audit category.

Reviewable guidanceImpact, context, and a suggested way forward.

Fresh, scoped resultA new audit confirms the updated source snapshot.

20 category scoresSeverity-ranked findingsFile-level referencesReviewable repair guidance

See the anatomy of a finding.

Each finding is structured to help a reviewer move from “something may be wrong” to a specific place, reason, and next action.

File-level findingHigh · Security

app/api/webhooks/route.ts · request handler

Verify the provider signature before processing.

The handler accepts and acts on a request body before establishing that it came from the expected provider.

const payload = await request.json();
await processEvent(payload);

Where

A file path and, when available, a line range identify the source location connected to the finding.

What

The finding explains the observed pattern, its severity, category, and why it matters in the submitted source.

Evidence

Relevant excerpts and context make the result inspectable instead of asking your team to trust a label alone.

Next action

Suggested remediation, prompts, or patches give reviewers a concrete starting point without applying changes automatically.

Turn the report into a controlled workflow.

The evidence is designed to support decisions. Suggested changes remain guidance until your team reviews, applies, and verifies them.

Prioritize

Sort the private findings by severity, confidence, pillar, and affected source area.

Decide what needs attention first

Repair

Use the evidence and suggested next action inside your existing engineering review process.

Your team controls every change

Re-audit

Submit the updated source and compare a fresh result against the previous audit.

Confirm the current snapshot

Publish

Issue an eligible result only when its score, scope, coverage, and fingerprint are ready to share.

Public disclosure stays scoped

Detailed evidence stays private.

The private report contains the information your team needs to investigate and improve the code.

Private report

Detailed findings, file references, excerpts, confidence, severity, remediation guidance, workflow state, and internal review activity.

Public verification

Only the issued score, public status, scope, date, audit version, fingerprint, and explicitly supported summary fields—not the proprietary source or private findings.

Get evidence tied to the source.

Assess one repository snapshot against the complete V2P rubric, then use the private report to decide what happens next.

Start your source audit Read the 20-point methodology