How EvalScope scores
Declared input in, exposure report out. No live systems are ever touched.
Finding classes
| Class | Severity | What it means |
|---|---|---|
private_key_block | CRITICAL | A private key header in declared content — revoke, purge, move to a secrets store. |
admin_managed_policy | CRITICAL | AdministratorAccess / PowerUserAccess referenced — replace with least-privilege. |
wildcard_principal | CRITICAL | Policy principal * — can expose the resource publicly. |
aws_access_key_id, aws_secret_access_key, github_token, generic_api_key, generic_secret_assignment | HIGH | Secret-like patterns — presence, file, and line reported; values never stored or shown. |
wildcard_iam_action, wildcard_iam_service | HIGH | "Action": "*" or "s3:*" — scope to exact APIs. |
public_bucket_acl, open_ingress | HIGH | Public-read storage, 0.0.0.0/0 ingress — restrict to who needs it. |
jwt_token, open_binding, debug_mode_enabled | MEDIUM | Token material, all-interface binds, debug on — tighten before exposure. |
debug_route | LOW | Debug/admin route strings — confirm they're not production-exposed. |
Scoring
Start at 100. Subtract 25 per CRITICAL, 15 per HIGH, 8 per MEDIUM, 3 per LOW. Floor at 0. Grades: A ≥ 90, B ≥ 75, C ≥ 50, D ≥ 25, F below. Deterministic — the same input always yields the same report.
What EvalScope will never do
- Touch live credentials, call cloud APIs, or authenticate anywhere.
- Store or display secret values — only presence, location, and pattern class.
- Probe a finding against a live system. Anything needing a live check stays a finding, not a probe.
Honest scope: declared/public surfaces only. This finds exposure; it never proves exploitability and cannot see your private infrastructure.