Scan configuration

A scan can switch off any part of the methodology — a single component, a whole metric, or an entire category. This exists for legitimate narrowing (an internal policy that excludes popularity signals, a security-only certification) while keeping every published result honest: the configuration is embedded in the report itself, so it is always explicit what was and was not measured.

How disabling works

Disabling behaves exactly like missing data (see the health index): the disabled item is excluded and the remaining weights are renormalized. The result stays on the 1–100 scale and is never dragged down by a zero for something deliberately not measured. Disabling every metric in a category — or the category itself — drops that category from the overall index, with its weight redistributed.

// scan-config.json
{
  "disabled_categories": ["security"],
  "disabled_metrics": ["popularity"],
  "disabled_components": {
    "documentation": ["Wiki", "Topics"]
  }
}

Category and metric keys are the identifiers documented in each wiki article (security, popularity, security_posture, …); component names are the exact display names shown on metric cards (Wiki, Stars, README, …). Unknown keys are reported as warnings and ignored.

What configuration cannot do

Configuration selects which parts of the fixed methodology are active — it never changes a formula, a weight, or a band threshold. Those remain governed by the versioned methodology (see methodology versions). There is no mechanism, paid or otherwise, to adjust how an active metric is computed.

How a configured scan reads

• Every report carries its configuration at the top level, so the result is reproducible as published.
• The report renders a scan configuration section listing everything that was disabled — or states that the full methodology ran.
• Each affected metric's note records the renormalization, at the exact place a reader would look.

Related: the health index · signals, not warranties