> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vibescale.run/llms.txt
> Use this file to discover all available pages before exploring further.
# Security — Overview
> Understand how VibeScale analyzes your repository's security and why finding classification is the differentiator that matters.
## What is analyzed
Identifies insecure patterns directly in the code you wrote: injections, missing validations, sensitive data exposure, and other logic issues.
Checks for known vulnerabilities in the libraries your project imports, including transitive dependencies.
Searches for credentials, tokens, and API keys that may have been accidentally committed to the repository.
Evaluates risks that manifest at runtime — server configurations, security headers, and exposed attack surface.
## The classification that changes everything
Most security tools dump all findings into a single list. The result: dozens of alerts, half of them from development tools that never go live — and you don't know where to start.
VibeScale classifies each finding into one of three categories:
Vulnerabilities introduced directly by the code your team wrote. **These are your responsibility and your priority.** They carry maximum weight in the score and appear highlighted in the report.
Flaws in libraries your project imports. Worth reviewing — especially critical ones — but rarely require immediate action, since they depend on a package update, not a change in your own code.
Findings from packages used only in development that never reach production. They do not affect your score. Hidden by default and can be shown when needed.
Focus on **Authored** findings first. They are the only problems you can fix directly in your own code today.
## Next steps
Learn how to start the scan and what to expect during analysis.
Understand the grade, finding categories, and how to act on each one.
See exactly how we calculate your score from A to E.