{
  "_comment": "Copy this file, adjust values to fit your org's risk appetite, and pass it with --scoring-config <path>. All sections are optional — omit any section to keep the default.",
  "riskScores": {
    "CRITICAL": 10,
    "HIGH": 7,
    "MEDIUM": 4,
    "LOW": 1,
    "INFO": 0
  },
  "checkWeights": {
    "_comment": "Override the weight for a specific check regardless of its riskLevel. To use: remove this _comment key.",
    "agent-action-surface": 4,
    "agent-channel-exposure": 4,
    "agent-inventory": 4,
    "agent-monitoring-coverage": 4,
    "agent-outbound-actions": 4,
    "agent-query-reach": 4,
    "agent-user-privilege": 4,
    "anonymous-apex-audit": 4,
    "apex-crud-fls": 4,
    "apex-logging": 4,
    "apex-rest-endpoint": 4,
    "apex-sharing": 7,
    "api-client-permission": 4,
    "api-limits": 4,
    "audit-trail": 4,
    "auth-provider-registration-handler": 4,
    "auth-providers": 4,
    "certificate-expiry": 4,
    "classic-sites": 4,
    "code-security": 4,
    "connected-app-inactivity": 4,
    "connected-app-scope": 4,
    "connected-apps": 7,
    "content-links": 4,
    "cors-allowlist": 4,
    "csp-trusted-sites": 4,
    "custom-labels-credential": 4,
    "custom-settings": 4,
    "data-classification": 4,
    "data-cloud-data-space-isolation": 4,
    "data-export-access": 4,
    "debug-log-access": 4,
    "delegated-administration-groups": 4,
    "delegated-authentication-exposure": 4,
    "deployment-identity": 4,
    "email-security": 4,
    "encryption-coverage": 4,
    "enhanced-domains": 4,
    "escalation-perms": 4,
    "event-monitoring": 4,
    "experience-cloud-site": 4,
    "experience-csp": 4,
    "external-account-hierarchy-exposure": 4,
    "external-credentials": 4,
    "failed-login-detection": 4,
    "field-history-tracking": 4,
    "field-level-security": 7,
    "flow-http-callout-credential-bypass": 4,
    "flows-without-sharing": 7,
    "genai-prompt-template-grounding": 4,
    "guest-api-access": 4,
    "guest-executable-apex": 4,
    "guest-object-exposure": 4,
    "guest-record-access-policy": 4,
    "guest-site-options": 4,
    "guest-traffic-anomaly": 4,
    "guest-user-access": 10,
    "guest-user-visibility": 4,
    "hardcoded-credentials": 10,
    "health-check": 7,
    "high-assurance-session": 4,
    "inactive-users": 4,
    "inbound-email-handler-exposure": 4,
    "installed-packages": 4,
    "integration-least-privilege": 4,
    "integration-users": 4,
    "internal-user-mfa": 4,
    "ip-restrictions": 7,
    "legacy-api-version": 4,
    "lightning-message-channel": 4,
    "login-access-policy": 4,
    "login-anomaly": 4,
    "login-session": 4,
    "mfa-enforcement": 4,
    "mfa-method-strength": 4,
    "mfa-registration": 4,
    "my-domain-login-policy": 4,
    "named-credentials": 1,
    "oauth-device-and-asset-token-flows": 4,
    "oauth-token-inventory": 4,
    "org-wide-email-spoofing": 4,
    "outbound-messages": 4,
    "package-post-install-supply-chain": 4,
    "password-session-policy": 7,
    "permissions": 4,
    "platform-event-subscriber-context": 4,
    "privileged-access": 4,
    "public-content-exposure": 4,
    "public-group-sharing": 4,
    "release-updates": 4,
    "remote-sites": 4,
    "report-folder-access": 4,
    "restriction-rules-integrity": 4,
    "sandbox-data-masking": 4,
    "scheduled-apex": 1,
    "separation-of-duties": 4,
    "session-hardening": 4,
    "sharing-model": 7,
    "shield-tenant-secret-lifecycle": 4,
    "siem-integration": 4,
    "soap-login-api-auth": 4,
    "sso-enforcement": 4,
    "standard-profiles": 4,
    "threat-detection": 4,
    "transaction-security-policy": 4,
    "trusted-ip-ranges": 4,
    "trusted-url-hygiene": 4,
    "users-and-admins": 10,
    "visualforce-xss": 4
  },
  "gradeThresholds": {
    "A": {
      "minScore": 85,
      "maxHigh": 0
    },
    "B": {
      "minScore": 70,
      "maxHigh": 1
    },
    "C": {
      "minScore": 55,
      "maxHigh": 3
    },
    "D": {
      "minScore": 40,
      "maxCritical": 0
    },
    "F": {}
  }
}