Security grades A–F and the Denofy quality grade

A "verified" badge says that all checks passed. It does not say how close a package with warnings is to passing, or how a clean package compares to another clean package. Two new grades answer that.

Security grade A–F#

Every version now gets a security grade, computed only from its verification report:

• it starts at 100 points;
• every finding deducts points by its effective severity — the same curl | bash counts in full in a script, much less in prose and only as information in an explicit "never do this";
• license problems, new risks since the previous version and structure errors deduct points too;
• some rules cap the grade: any critical finding means F, a high one C at most, and a finding the author allowed in denofy.yml B at most.

The grade is on every card, on the package page (with each deduction explained in the report tab) and in the README badge. Search can filter by it (minGrade=B) and sort by it. All rules and weights are on the methodology page, and /security shows how the registry as a whole is doing.

Quality grade S, A, B, C#

Security is not everything. The new quality grade combines five things:

Usage counts distinct clients per day, without bots and without CI, on a logarithmic scale. Ratings use a Bayesian average, so one 5-star review cannot outrank fifty good ones. S also needs security grade A. Everything is explained on the ranking methodology.

What authors can do#

• Fix findings or mark examples of what not to do — see Writing secure skills.
• Add use_when and avoid_when to the frontmatter — they count towards documentation and help people decide.
• Keep the package maintained: a new version every few months keeps the maintenance score up.