The severity mapping is fixed in src/verdict.ts. Renderers consume the assigned value; they do not reinterpret codes.
| Code | Severity | Meaning |
|---|---|---|
DEAD_UPSTREAM | error | A registry or vhost backend port has no listening socket. |
BROKEN_PROXY | error | An nginx upstream points to a local port with no listener. |
UNREGISTERED_PORT | warn | A listening port inside the convention range is absent from the registry. |
CONVENTION_VIOLATION | warn | A non-exempt registered port falls outside the configured convention range. |
PORT_COLLISION | error | Two or more registry entries claim the same port. |
REGISTRY_ORPHAN | info | A registered, listening port is not referenced by an nginx vhost. |
CERT_EXPIRING | warn | A live certificate has fewer than 14 days remaining. |
CERT_EXPIRED | error | A live certificate is past its expiry time. |
CERT_MISMATCH | warn | The live certificate does not cover the probed hostname. |
TLS_ERROR | error | The TLS handshake or certificate read failed. |
PLAINTEXT_ONLY | info | A non-redirect vhost has no listener on port 443. |
GATE_MISMATCH | warn | Configured edge authentication and the observed response disagree in either direction. |
UPSTREAM_5XX | error | The live HTTP probe returned a 5xx response. |
HTTP_ERROR | warn | The live HTTP probe failed or timed out without a usable response. |
MISSING_ROOT | error | A configured static root path does not exist. |
WORLD_EXPOSED | warn | A convention-range socket listens beyond loopback. |
UNIT_FAILED | warn | A system or user service reports failed in either its ACTIVE or SUB column. |
Exact severity policy
- error:
DEAD_UPSTREAM,BROKEN_PROXY,PORT_COLLISION,CERT_EXPIRED,TLS_ERROR,UPSTREAM_5XX,MISSING_ROOT. - warn:
UNREGISTERED_PORT,CONVENTION_VIOLATION,CERT_EXPIRING,CERT_MISMATCH,GATE_MISMATCH,HTTP_ERROR,WORLD_EXPOSED,UNIT_FAILED. - info:
REGISTRY_ORPHAN,PLAINTEXT_ONLY.
Certificate thresholds are exact: negative daysLeft is expired; zero through 13 days is expiring. A successful TLS probe can emit a lifetime finding and CERT_MISMATCH together. Findings are deduplicated by code and subject, then sorted by error, warn, info; code; and subject.
Severity controls process status, not visibility. Every finding remains in terminal, JSON, and HTML output unless a scoped scan suppresses a host-wide code.
Exit codes
0: scan completed with no error findings
1: one or more error findings; with --strict, one or more warnings also qualifies
2: argument parsing, collection, probing, rendering, or file output crashed the scan--quiet, --json, --html, and --out change presentation or destinations, not exit-code evaluation.