Skip to navigation

Score reports

A score report is a private, per-company view of what the Writ scanner found in public source code. It is not a leaderboard or a public listing. Each report is reachable only through a unique, token-gated link sent to a contact at the scanned company.

What the scanner measures

The scanner looks for write-sites: places in code where an application or an AI agent can change data, move money, alter identity records, send messages, or otherwise act on the world. Each write-site is mapped to a verb and classified by risk class:

  • Money: refunds, charges, payouts, invoices
  • Database: commits, updates, inserts, deletes
  • Auth and identity: role changes, credential rotation, permission grants
  • Email: sends to users or customers
  • Filesystem: file writes, deletions, moves
  • Network: POST/PUT/PATCH/DELETE calls to external APIs, webhooks, deploys
  • Other: writes that do not match the above signals

How the Writ Score is computed

The Writ Score is a 0-100 number based on the share of found write-sites that sit behind a Writ policy check. A score of 100 means every detected write-site is gated. A lower score means more ungated write-sites remain in the scanned code. The score reflects the public code scanned on a specific date; it is recomputed when a new scan is submitted.

What a reveal page contains

The private reveal page shows:

  • The company name and scan date.
  • The Writ Score and the total number of write-sites found.
  • The number of ungated write-sites, broken down by risk class.
  • The top three example write-sites: file path, line, verb, and a short snippet.
  • The number of additional findings in the full report.

The full findings list, which includes every file and line, is unlocked only after the recipient claims the report.

How claiming works

Claiming links the report to a Writ portal tenant. The recipient chooses one of two paths:

  1. Work email: creates a Writ portal tenant and attaches the report to it.
  2. GitHub App install: installs the Writ GitHub App on the repository so every push and pull request is scanned, and attaches the report to the tenant.

After claiming, the full report is visible inside the portal. The tenant can re-scan the repository at any time from CI; the score report updates when a new signed manifest is submitted.

What the scan does and does not cover

The score report covers only public repositories scanned on the date shown. It describes write surfaces present in that public code. It is not a claim about internal systems, production infrastructure, or private repositories, which may differ. If you believe a finding is wrong, claim the report and reply to the email that brought you there. Verified corrections are applied and the score is reissued.

Pricing

Reading a score report and claiming it is free. After claiming, the tenant can run the first 10,000 receipts per month at no charge. Usage above the free tier is billed at $1 per 1,000 receipts.