What a Codebase Health Score Actually Measures
A single grade for a whole codebase is easy to misread. It's useful as a starting point and misleading as a verdict. This guide breaks down the seven dimensions Repolit assesses, what each one is really telling you, and how to use the breakdown rather than the headline number.
Why a breakdown beats a single grade
Two repositories can share the same overall grade for opposite reasons — one with strong tests and weak documentation, another the reverse. The overall score is a conversation-starter; the dimensions are where the decisions live. Repolit grades seven of them, each independently, so you can see the trade-offs instead of averaging them away.
The seven dimensions
Each dimension is graded on evidence found in the code and its history, and each answers a different practical question:
- Security — are there weakness patterns, exposed secrets, or risky constructs that warrant review?
- Code quality — is the code consistent, readable, and free of obvious smells that slow future change?
- Documentation — can a newcomer or an AI assistant understand intent from what's written down?
- Testing — is behavior covered well enough that changes are safe to make?
- Dependencies — are third-party packages current, and do any match known-vulnerable versions?
- Architecture — are the boundaries between components clear, or is everything coupled to everything?
- Maintainability — taken together, how hard will this code be to change six months from now?
How to read the grades
Read the lowest dimensions first — they tell you where your next hour is best spent. A low testing grade in a module you're about to change is a signal to add coverage before you touch it; a dependencies flag is a signal to update before you build on top.
Resist treating any grade as a compliance stamp. A health score is an assessment to guide attention, not a certification. In particular, the security dimension is an AI-assisted review of common weakness patterns and a curated dependency check — it is not a certified SAST scan or a substitute for a formal audit.
Using the score over time
The most valuable use of a health score is as a trend, not a snapshot. Re-run it as the codebase evolves and watch whether the weak dimensions are improving. That turns an abstract goal like "improve quality" into something concrete: raise the testing grade in this module, clear the flagged dependency, document the two components a newcomer always gets stuck on.
Key takeaways
- The seven dimensions are security, code quality, documentation, testing, dependencies, architecture, and maintainability.
- Read the lowest dimensions first — they show where attention pays off.
- A health score guides attention; it is not a certification, and the security dimension is an AI-assisted review, not a certified SAST scan.
- Tracked over time, the breakdown turns vague quality goals into concrete, measurable work.
RELATED IN REPOLIT
Frequently asked questions
- What does a codebase health score measure?
- Repolit grades seven independent dimensions: security, code quality, documentation, testing, dependencies, architecture, and maintainability. Each is assessed on evidence from the code and its history, so you see specific strengths and weaknesses rather than one averaged number.
- Is a health score the same as a security certification?
- No. A health score is an assessment to guide attention. The security dimension is an AI-assisted review of common weakness patterns plus a curated dependency check — it is not a certified SAST scanner or a compliance audit.
Try it on your own codebase.
Start a 14-day Pro Plus trial. No credit card — billing isn't live yet.