The severity mapping is fixed in src/verdict.ts. Renderers consume the assigned value; they do not reinterpret codes.

CodeSeverityMeaning
DEAD_UPSTREAMerrorA registry or vhost backend port has no listening socket.
BROKEN_PROXYerrorAn nginx upstream points to a local port with no listener.
UNREGISTERED_PORTwarnA listening port inside the convention range is absent from the registry.
CONVENTION_VIOLATIONwarnA non-exempt registered port falls outside the configured convention range.
PORT_COLLISIONerrorTwo or more registry entries claim the same port.
REGISTRY_ORPHANinfoA registered, listening port is not referenced by an nginx vhost.
CERT_EXPIRINGwarnA live certificate has fewer than 14 days remaining.
CERT_EXPIREDerrorA live certificate is past its expiry time.
CERT_MISMATCHwarnThe live certificate does not cover the probed hostname.
TLS_ERRORerrorThe TLS handshake or certificate read failed.
PLAINTEXT_ONLYinfoA non-redirect vhost has no listener on port 443.
GATE_MISMATCHwarnConfigured edge authentication and the observed response disagree in either direction.
UPSTREAM_5XXerrorThe live HTTP probe returned a 5xx response.
HTTP_ERRORwarnThe live HTTP probe failed or timed out without a usable response.
MISSING_ROOTerrorA configured static root path does not exist.
WORLD_EXPOSEDwarnA convention-range socket listens beyond loopback.
UNIT_FAILEDwarnA system or user service reports failed in either its ACTIVE or SUB column.

Exact severity policy

  • error: DEAD_UPSTREAM, BROKEN_PROXY, PORT_COLLISION, CERT_EXPIRED, TLS_ERROR, UPSTREAM_5XX, MISSING_ROOT.
  • warn: UNREGISTERED_PORT, CONVENTION_VIOLATION, CERT_EXPIRING, CERT_MISMATCH, GATE_MISMATCH, HTTP_ERROR, WORLD_EXPOSED, UNIT_FAILED.
  • info: REGISTRY_ORPHAN, PLAINTEXT_ONLY.

Certificate thresholds are exact: negative daysLeft is expired; zero through 13 days is expiring. A successful TLS probe can emit a lifetime finding and CERT_MISMATCH together. Findings are deduplicated by code and subject, then sorted by error, warn, info; code; and subject.

Severity controls process status, not visibility. Every finding remains in terminal, JSON, and HTML output unless a scoped scan suppresses a host-wide code.

Exit codes

0: scan completed with no error findings
1: one or more error findings; with --strict, one or more warnings also qualifies
2: argument parsing, collection, probing, rendering, or file output crashed the scan

--quiet, --json, --html, and --out change presentation or destinations, not exit-code evaluation.