HOW IT DECIDES
Structure and data decide, not the tool that built it
Each risk is weighed by what the project handles and whether it is already live.
- Credentials in the code, no backups, no access control, no repository and hosting on someone else's account are serious on their own; with accounts or payments, more answers become serious.
- Two serious risks, or one with payments involved, means not ready. One serious or three medium ones means usable with conditions.
- 'I do not know' is scored as a medium risk, because it usually is, and it is exactly what a review resolves first.
- A rebuild is only recommended when the structural pieces are all missing; everything else is fixed in order.
