How exposure is scored

The exposure level is deterministic and additive. The same store, in the same place, always scores the same way. There is no machine learning and no hidden heuristic. This page is the whole model, so you can predict and audit any rating you see.

The formula

Every store starts with a base, set by how sensitive its kind of data is:

Sensitivity	Base
Low	1
Medium	2
High	3

Then each amplifier acting on the store adds a weight:

Amplifier	Weight
cloud_sync	2
in_git_repo	2
world_readable	1
unencrypted_disk	1
backup_swept	0 (informational)
large_growth	0 (informational)

The base plus the amplifier weights give a total, and the total maps to a level:

Total	Level
0 to 1	info
2	low
3	medium
4	high
5 or more	critical

Why the informational amplifiers weigh zero

backup_swept and large_growth are real and worth seeing, but they do not, on their own, mean data has left your control. A large transcript is still just a local file. A backed-up file is exposed to the same degree your backup is. So they are reported and they raise no level. Weighting them at zero keeps the ranking honest: the level tracks how far the data has spread, not how big it is.

Why critical means off-machine exposure

Look at what it takes to reach a total of 5. The highest base is 3. The only amplifiers heavy enough to push a store to critical are cloud_sync and in_git_repo, both weighted 2, and both meaning the data now has a copy somewhere other than this one disk: on a sync provider’s servers and every device you sync, or in a repository’s history that may be shared or pushed.

So a critical rating is never about a single quiet local file. It always means a copy is off the machine. That is a deliberate property of the weights, not a coincidence.

Worked examples

• A low-sensitivity cache on an encrypted disk, in no backup: base 1, no weighted amplifiers, total 1, level info.
• A high-sensitivity transcript on an unencrypted disk: base 3 plus 1, total 4, level high.
• The same high-sensitivity transcript inside a synced folder: base 3 plus 2, total 5, level critical.
• A medium-sensitivity store committed inside a git repo: base 2 plus 2, total 4, level high.

It ranks attention, it does not pass or fail

The score exists to sort a long list so the stores most worth your attention are at the top. It is not a grade. A critical store is not a failure, and an info store is not a guarantee. The point is to tell you where to look first, then let you decide.

The weights live in one place in the open-source engine and change only as a single reviewed edit, with guard tests. If you disagree with a weighting, you can read it, and you can open an issue.