Skip to main content

​
The score

Every scan produces a 0–100 score (100 = safe) with a per-server breakdown and four category scores: Prompt Security, Tool Security, Data Protection, Supply Chain.

​
Paths cap the score

An environment of individually clean servers can still be dangerous together, so attack paths cap the overall score regardless of per-server results: The report always says why: Score capped at 39: critical attack path: AP001 …. --fail-on counts paths too, so CI fails on a critical composition even when every server passes alone.

​
Blast radius

Not a number. A list of factors, each shown present or absent in aspex scan, bom, diff and the lockfile:

​
History

Each scan writes a JSON log and, when the environment changed, a lockfile-shaped snapshot to your user cache directory. On later runs the score box shows the delta and the report ends with the highest-impact fixes, ranked by the risk each one retires. Real output:
Fixes are ranked by the criticals and highs they clear, not by a “+N points” estimate: the score is pulled toward the worst server and capped by any attack path, so a per-fix point number would be misleading. The list tells you what each fix actually removes. aspex history replays the snapshots: servers, tools, attack paths and blast radius per point, and the security-relevant changes between them.

​
Accepting risk

Accept a path or rule in .aspex.yaml by ID, with a reason and an expiry. --save-baseline records current findings; --baseline hides the ones that were already there so CI only fails on new ones. Policy & baselines →