Remove score from App Security scan output

Co-authored-by: AI (Pi/Claude Opus 5.5) <noreply@pi.dev>

Author: jplhomer

packages/app/src/cli/services/app-security-engine/run.ts

@@ -203,7 +203,6 @@ export async function compileFindings(
   // Stale documents must not suppress current findings or crash compile when fingerprints no longer exist.
   const suppressions = provenanceRejected.length > 0 ? [] : (document.suppressions ?? [])
   if (rejected.length > 0) {
-    result.score = null
     result.scan.coverage_complete = false
     result.scan.coverage_gaps.push(
       ...rejected.map((message) => {
@@ -216,7 +215,7 @@ export async function compileFindings(
       }),
     )
   }
-  result.scan.result_hash = computeResultHash(result.issues, result.score)
+  result.scan.result_hash = computeResultHash(result.issues)
 
   const trace = compileTrace(result, {engineVersion, agentChecksExecuted, suppressions})
   return {

packages/app/src/cli/services/app-security-engine/scanners/index.ts

@@ -12,7 +12,7 @@ import {
   findDependencyAutomationInputs,
 } from './discover.js'
 import {detectCapabilities, detectProject} from '../capabilities/detect.js'
-import {calculateScore, computeScanMetadata} from '../scorer/index.js'
+import {computeScanMetadata} from '../scorer/index.js'
 import {deprecatedScriptTagScope, insecureWebhookUrl} from '../rules/config-rules.js'
 import {
   scanCredentialBrowserLeakage,
@@ -754,14 +754,12 @@ export async function scan(startPath?: string, configFileName?: string): Promise
           ],
     ),
   ]
-  const score = coverageGaps.length === 0 ? calculateScore(issues) : null
   const rulesRun = checksExecuted.filter((execution) => execution.status === 'executed').length
   const scanMetadata = computeScanMetadata(
     sourceFiles.filter((file) => file.content !== undefined).length,
     rulesRun,
     checksExecuted.length - rulesRun,
     issues,
-    score,
     fileHashMap,
     skippedFiles,
     checksExecuted,
@@ -774,7 +772,6 @@ export async function scan(startPath?: string, configFileName?: string): Promise
     app: {name: redactText(String(appToml?.raw.name ?? 'Unknown')), type: 'public'},
     capabilities,
     detection,
-    score,
     scan: scanMetadata,
     issues,
   }

packages/app/src/cli/services/app-security-engine/scorer/index.ts

@@ -1,39 +1,8 @@
 import {canonicalJson, sha256} from '../trace/index.js'
 import {getEngineVersion} from '../version.js'
-import type {CheckExecution, CoverageGap, Issue, ScoreResult, Grade, ScanMetadata, SkippedFile} from '../types.js'
+import type {CheckExecution, CoverageGap, Issue, ScanMetadata, SkippedFile} from '../types.js'
 
-const BASELINE = 100
-
-/** Only deterministic, definite evidence can affect a grade. */
-export function calculateScore(issues: Issue[]): ScoreResult {
-  let total = BASELINE
-  const deductedEvidence = new Set<string>()
-
-  for (const issue of issues) {
-    if (issue.found_by === 'agent' || issue.found_by === 'external') continue
-    if (issue.confidence !== 'definite' && issue.confidence !== undefined) continue
-    const evidenceKey = canonicalJson({
-      id: issue.id,
-      location: issue.location,
-      evidence: issue.evidence ?? [],
-    })
-    if (deductedEvidence.has(evidenceKey)) continue
-    deductedEvidence.add(evidenceKey)
-    total += issue.points
-  }
-
-  total = Math.max(0, Math.min(100, total))
-  return {total, baseline: BASELINE, grade: scoreToGrade(total)}
-}
-
-function scoreToGrade(score: number): Grade {
-  if (score >= 90) return 'EXCELLENT'
-  if (score >= 75) return 'GOOD'
-  if (score >= 60) return 'NEEDS_WORK'
-  return 'POOR'
-}
-
-export function computeResultHash(issues: Issue[], score: ScoreResult | null): string {
+export function computeResultHash(issues: Issue[]): string {
   const canonicalIssues = issues
     .map((issue) => ({
       id: issue.id,
@@ -51,15 +20,14 @@ export function computeResultHash(issues: Issue[], score: ScoreResult | null): s
       fix: issue.fix,
     }))
     .sort((left, right) => canonicalJson(left).localeCompare(canonicalJson(right)))
-  return sha256({issues: canonicalIssues, score})
+  return sha256({issues: canonicalIssues})
 }
 
 export function computeScanMetadata(
   filesScanned: number,
   rulesRun: number,
   rulesSkipped: number,
   issues: Issue[],
-  score: ScoreResult | null,
   fileHashMap: Record<string, string>,
   filesSkipped: SkippedFile[],
   checksExecuted: CheckExecution[],
@@ -80,7 +48,7 @@ export function computeScanMetadata(
     coverage_complete: coverageGaps.length === 0,
     coverage_gaps: coverageGaps,
     input_hash: sha256(inputs),
-    result_hash: computeResultHash(issues, score),
+    result_hash: computeResultHash(issues),
     file_hashes: fileHashMap,
     checks_executed: checksExecuted,
   }

packages/app/src/cli/services/app-security-engine/tests/dependency-automation.test.ts

@@ -94,7 +94,6 @@ describe('dependency automation scanner integration', () => {
         findings: 1,
         inspected_files: ['extensions/app-home/package.json', 'package.json'],
       })
-      expect(execution.scan.score).toEqual({total: 95, baseline: 100, grade: 'EXCELLENT'})
       expect(formatJson(execution.scan)).toContain(checkId)
       expect(validateTrace(execution.trace)).toEqual({valid: true, errors: []})
       const submission = buildSubmission(execution.trace, {cliVersion: '3.99.0', submittedAt: '2026-09-15T00:00:00Z'})
@@ -126,7 +125,6 @@ describe('dependency automation scanner integration', () => {
           findings: 0,
           inspected_files: expectedFiles,
         })
-        expect(execution.scan.score).toEqual({total: 100, baseline: 100, grade: 'EXCELLENT'})
         expect(execution.trace.project.input_hashes[path]).toBe(sha256(content))
         expect(securityExitCode({...execution, elapsedMilliseconds: 0}, 'low')).toBe(0)
         const submission = buildSubmission(execution.trace, {cliVersion: '3.99.0', submittedAt: '2026-09-15T00:00:00Z'})
@@ -174,7 +172,7 @@ describe('dependency automation scanner integration', () => {
       const result = await scan(root)
       expect(dependencyFindings(result)).toEqual([])
       expect(dependencyExecution(result)).toMatchObject({status: 'unresolved', findings: 0})
-      expect(result.score).toBeNull()
+      expect(result.scan.coverage_complete).toBe(false)
     })
   })
 

packages/app/src/cli/services/app-security-engine/tests/scan-contract.test.ts

@@ -4,12 +4,11 @@ import {assertRegistryInvariants, getRegistry} from '../registry/index.js'
 import {DETERMINISTIC_CHECKS, scan} from '../scanners/index.js'
 import {compileTrace, sha256, validateTrace} from '../trace/index.js'
 import {RULE_CATALOG} from '../rules/catalog.js'
-import {calculateScore} from '../scorer/index.js'
 import {afterEach, describe, expect, test} from 'vitest'
 import {mkdir, mkdtemp, rm, writeFile} from 'node:fs/promises'
 import {tmpdir} from 'node:os'
 import {join} from 'node:path'
-import type {Issue, TraceV2} from '../types.js'
+import type {TraceV2} from '../types.js'
 
 const directories: string[] = []
 afterEach(async () => {
@@ -38,7 +37,7 @@ function resign(trace: TraceV2): void {
 }
 
 describe('framework and surface detection', () => {
-  test('grades the React Router green path only when package and structure agree', async () => {
+  test('detects React Router only when package and structure agree', async () => {
     const directory = await app({
       'shopify.app.toml': appConfig(),
       'package.json': reactPackage,
@@ -53,7 +52,7 @@ describe('framework and surface detection', () => {
   test('detects config-only, theme extension, mixed, and unknown surfaces', async () => {
     const configOnly = await scan(await app({'shopify.app.toml': appConfig()}))
     expect(configOnly.detection).toMatchObject({framework: 'none', surface: 'config_only'})
-    expect(configOnly.score).not.toBeNull()
+    expect(configOnly.scan.coverage_complete).toBe(true)
 
     const theme = await scan(
       await app({
@@ -78,7 +77,7 @@ describe('framework and surface detection', () => {
 
     const unknown = await scan(await app({'shopify.app.toml': appConfig(), 'server.ts': 'export const server = {}'}))
     expect(unknown.detection).toMatchObject({framework: 'unknown', surface: 'unknown'})
-    expect(unknown.score).toBeNull()
+    expect(unknown.scan.coverage_complete).toBe(false)
     expect(
       unknown.scan.checks_executed.find((execution) => execution.id === 'MISSING_COMPLIANCE_WEBHOOKS'),
     ).toMatchObject({status: 'executed'})
@@ -415,7 +414,6 @@ redirect_urls = ["http://app.example/callback"]
       reason: {code: 'input_rejected'},
     })
     expect(result.scan.coverage_complete).toBe(false)
-    expect(result.score).toBeNull()
     expect(result.issues.map((issue) => issue.id)).toContain('DEPRECATED_SCRIPT_TAG_SCOPE')
   })
 })
@@ -459,21 +457,6 @@ describe('runtime identities', () => {
 })
 
 describe('coverage and trace invariants', () => {
-  test('does not double-deduct agent and deterministic evidence for one product', () => {
-    const issue: Issue = {
-      id: 'UNSAFE_INNERHTML',
-      severity: 'high',
-      points: -25,
-      title: 'Unsafe HTML',
-      message: 'Unsafe HTML',
-      location: {file: 'app/a.ts', line: 1},
-      evidence: [{location: {file: 'app/a.ts', line: 1}, quote: 'element.innerHTML = input'}],
-      fix: {automated: false, description: 'Sanitize input.'},
-      found_by: 'static',
-    }
-    expect(calculateScore([issue, {...issue, found_by: 'agent', confidence: 'agentic'}]).total).toBe(75)
-  })
-
   test('rejects impossible execution and completeness combinations', async () => {
     const directory = await app({
       'shopify.app.toml': appConfig(),

packages/app/src/cli/services/app-security-engine/tests/trace.test.ts

@@ -35,7 +35,6 @@ const result = (issues: Issue[] = []): ScanResult => ({
     declared_ip_allowlist: false,
     checkout_extension: false,
   },
-  score: {total: 70, baseline: 100, grade: 'NEEDS_WORK'},
   scan: {
     timestamp: '2026-08-28T00:00:00.000Z',
     security_version: '0.1.0',
@@ -265,14 +264,12 @@ describe('trace v2', () => {
 
   test('recomputes the scan result hash over merged finding content', () => {
     const scanResult = result()
-    const before = computeResultHash(scanResult.issues, scanResult.score)
+    const before = computeResultHash(scanResult.issues)
     scanResult.issues.push(deterministicIssue())
-    expect(computeResultHash(scanResult.issues, scanResult.score)).not.toBe(before)
+    expect(computeResultHash(scanResult.issues)).not.toBe(before)
     const changed = deterministicIssue()
     changed.evidence = [{location: changed.location, quote: 'different'}]
-    expect(computeResultHash([changed], scanResult.score)).not.toBe(
-      computeResultHash([deterministicIssue()], scanResult.score),
-    )
+    expect(computeResultHash([changed])).not.toBe(computeResultHash([deterministicIssue()]))
   })
 
   test('hashes full finding messages, locations, snippets, and evidence independent of ordering', () => {

packages/app/src/cli/services/app-security-engine/types.ts

@@ -85,20 +85,10 @@ export interface ScanResult {
   }
   capabilities: Capabilities
   detection: ProjectDetection
-  /** Null means the deterministic coverage is insufficient to grade safely. */
-  score: ScoreResult | null
   scan: ScanMetadata
   issues: Issue[]
 }
 
-export interface ScoreResult {
-  total: number
-  baseline: number
-  grade: Grade
-}
-
-export type Grade = 'EXCELLENT' | 'GOOD' | 'NEEDS_WORK' | 'POOR'
-
 export interface SkippedFile {
   path: string
   reason: 'too_large' | 'unreadable'

packages/app/src/cli/services/app-security-json-fixtures/compile.json

@@ -33,11 +33,6 @@
       "declared_ip_allowlist": false,
       "checkout_extension": false
     },
-    "score": {
-      "total": 100,
-      "baseline": 100,
-      "grade": "EXCELLENT"
-    },
     "scan": {
       "timestamp": "2026-08-24T00:00:00.000Z",
       "security_version": "1.2.3",

packages/app/src/cli/services/app-security-json-fixtures/scan.json

@@ -33,11 +33,6 @@
       "declared_ip_allowlist": false,
       "checkout_extension": false
     },
-    "score": {
-      "total": 100,
-      "baseline": 100,
-      "grade": "EXCELLENT"
-    },
     "scan": {
       "timestamp": "2026-08-24T00:00:00.000Z",
       "security_version": "1.2.3",

packages/app/src/cli/services/app-security-json.test.ts

@@ -32,7 +32,6 @@ const scan: ScanResult = {
     declared_ip_allowlist: false,
     checkout_extension: false,
   },
-  score: {total: 100, baseline: 100, grade: 'EXCELLENT'},
   scan: {
     timestamp: '2026-08-24T00:00:00.000Z',
     security_version: '1.2.3',