score

package

v1.11.0 Latest Latest Go to latest Published: Aug 6, 2026 License: MIT Imports: 4 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/puck-security/geiger

Links

Open Source Insights

Documentation ¶

Overview ¶

Package score derives a relative blast-radius score and tier for a Note.

The score is composed from the intrinsic signals Geiger already collects — capability class (flags), reach (counts), and sensitivity tags (prod/pii/…) — because without externally-supplied context that is the most honest ranking available. Supplying a context (crown-jewel account IDs, prod hosts, critical repos) boosts matching findings: intrinsic signal ranks relative danger, context ranks danger to *you*.

Index ¶

func BlastRadius(n module.Note, ctx Context) int
func Rank(t Tier) int
type Context
- func (c Context) Matches(n module.Note) bool
type Tier
- func ParseTier(s string) (Tier, bool)
- func TierFor(n module.Note, ctx Context) Tier

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func BlastRadius ¶

func BlastRadius(n module.Note, ctx Context) int

BlastRadius returns a relative score (0 = dead/invalid). Higher is worse.

func Rank ¶

func Rank(t Tier) int

Rank returns a tier's severity rank (higher = more severe).

Types ¶

type Context ¶

type Context struct {
	Terms []string // e.g. account IDs, prod hostnames, critical repo names
}

Context is optional operator-supplied criticality: substrings whose presence in a finding marks the credential as touching a crown-jewel asset.

func (Context) Matches ¶

func (c Context) Matches(n module.Note) bool

Matches reports whether any context term appears in the note.

type Tier ¶

type Tier string

Tier is a coarse, honest bucket (we deliberately avoid a fake-precise 0-100).

const (
	TierCritical Tier = "CRITICAL"
	TierHigh     Tier = "HIGH"
	TierMedium   Tier = "MEDIUM"
	TierLow      Tier = "LOW"
	TierInfo     Tier = "INFO"
	TierUnknown  Tier = "UNKNOWN"
	TierDead     Tier = "DEAD"
)

func ParseTier ¶

func ParseTier(s string) (Tier, bool)

ParseTier maps a case-insensitive tier name to a Tier.

func TierFor ¶

func TierFor(n module.Note, ctx Context) Tier

TierFor maps a score to a tier. Context matches force at least HIGH, and a single force-multiplier finding (a named high-impact capability — RCE, wipe, full-DB, RLS-bypass) also floors at HIGH: such a capability should never rank merely MEDIUM just because reach couldn't be sized.

Source Files ¶

View all Source files

score.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL