Change the tables behind D1, D2 and D3 and every figure on the dashboards is recalculated. This is a what-if: it is saved in this browser only, and the published registry records never change. Defaults are the published tables.
Each fix gets a band from its effort lines and a band from its effort files (code files only; tests, docs and generated files are left out). D1 is the lines band, raised by the files band by at most the cap below. Above band 4's limits, D1 is 5.
| D1 | Up to lines | Up to files | Fixes (published → now) |
|---|
Each vuln's class is matched against these patterns from the top; the first pattern found anywhere in the class name sets D2 and D3, so order matters. A class that matches nothing gets the default. The study's table lists most classes more than one way (with a space and with a hyphen, or as both an abbreviation and a full name, such as "xss" and "cross-site scripting"); each class is one row here, so one edit sets them all (the saved table keeps every one). The small box under each class is the text matched; separate entries with /. A word that is not another way of writing the class becomes its own row just below.
| # | Class · text matched | D2 | D3 | Level | Fixes matched |
|---|
Projects graded before the pilot batches added or subtracted from D2/D3 by component (for example Django's ORM +1/+1). These are the adjustments as applied in the published registry, read from the records. They are added to the class table's scores and the result is kept within 1–5. New projects have none.
| Project | Component | Fixes | D2 ± | D3 ± |
|---|
The combined score (3–15) maps to engineer-days. Dollars follow at the daily rate set on the dashboard (the annual FTE cost there). A fix shared by several vulns is priced once and split, as in the registry.
Used by the dashboard's difficulty section.