Understanding compliancy ratings, rating bands and priorities
How to read the numbers, colours and labels used throughout the portal.
The portal expresses the technical quality of an application as compliancy ratings. This article explains what they mean.
Compliancy rating
A compliancy rating is a number between 0 and 100 that indicates how compliant the analysed code is with the best-practice rules that were checked. The higher the number, the more compliant – a rating of 100 means no findings were left for the rules in scope.
Ratings are calculated per compliancy area (also called dimension):
- Overall – the combined rating of the application.
- Maintainability – how easy the code is to understand and change.
- Reliability – how robust the code is against errors.
- Security – how well the code protects data and functionality.
- Performance – how efficiently the code uses resources.
- Open source – the licence and vulnerability risk of open-source components. This area only appears when your licence includes Open Source Analysis.
Ratings are pre-calculated when an analysis finishes. Accepting findings or excluding modules therefore does not change the rating immediately; the numbers refresh after the next analysis (recalculation).
Rating bands
Each rating is labelled with a band and a colour so you can read a dashboard at a glance:
- Very High (green)
- High (light green)
- Medium (amber)
- Low (orange)
- Very Low (red)
- — – no rating available (for example when an area is not analysed).
On the Overview page each band also carries a short qualifier such as Excellent, Good or Poor.
Trend indicators
Next to a rating you may see a trend arrow comparing the latest analysis with the previous one: ▲ Rising, = Flat or ▼ Declining. In comparison views a delta such as ▲ +4 shows the exact change.
Findings, priorities, impact and effort
A finding is one occurrence of a rule violation on one element (a microflow, class, page, attribute, and so on). Each rule has a priority: Very High, High, Medium, Low or Very Low. Priorities are derived from the rule's impact (how serious a violation is) and effort (how much work it typically takes to fix). Organisations can override impact and effort in their own rulesets.
Quality and Security (SAST) modules
Omnext offers two analysis modules. The Quality module covers the best-practice rules for maintainability, reliability, performance and general security. The Security (SAST) module adds advanced security rules, Access-rule analysis (Mendix) and Open Source Security Analysis. Pages and tabs only show the areas your licence covers; the Rule catalogue tells you exactly which modules and languages your organisation holds.