What the grades mean

Six steps

The scale, best first

The 0-5 scale and its letters are the ones scan.nextcloud.com made familiar, kept deliberately so that an existing threshold, graph or alert rule keeps its meaning. That is also why there is no B: the scale skips it, and inventing one here would make two numbers mean the same grade.

• A+

  Grade A+: Nothing found 5 out of 5

  The release is current for its track, no advisory matches the version, and every check the scan could run passed.

  To move up: Keep the instance up to date on your release track. Run another scan after changes to the reverse proxy or sign-in configuration.

• A

  Grade A: An update is waiting 4 out of 5

  A newer patch release is available on the same release line. No known advisories match the installed version.

  To move up: Install the recommended update within your release line.

• C

  Grade C: A release line behind 3 out of 5

  The instance uses an older release line than the latest on its track. That older line may still be supported.

  To move up: Move up to the current line for your track. The scan names which one that is, and never points at a track you did not choose.

• D

  Grade D: Advisories match this version 2 out of 5

  Known vulnerabilities affect the installed version. None of the matching advisories is rated high or critical.

  To move up: Upgrade to the fixed version for your release line. The result page names it - one advisory can be patched separately on several lines.

• E

  Grade E: A critical or high advisory matches 1 out of 5

  At least one known vulnerability affecting the installed version is rated high or critical.

  To move up: Install the fixed version listed in the report and review the advisory's instructions.

• F

  Grade F: Out of support 0 out of 5

  This release line no longer receives security fixes. It receives an F regardless of other findings or waivers.

  To move up: Move to a supported release line. Which lines are supported, and for how long, is on the release schedule the scan reads.

The ceiling

How failed checks limit the grade

The version determines the starting grade. Failed checks impose limits based on their severity. The lowest of these limits applies:

• critical → at best D 2 out of 5
• high → at best C 3 out of 5
• medium → at best A 4 out of 5
• low → at best A+ 5 out of 5

Findings with the same severity impose the same grade limit. If three medium findings remain, fixing only one does not remove that limit. The remediation plan keeps all three steps and shows when the grade would improve.

Two rules take precedence. End of life always determines the grade: an unsupported release receives F, even with waivers. A release ahead of its declared track is not treated as outdated; the report identifies it as ahead of that track.

The shortest route

From findings to fixes

Each result includes the information you need to plan the work:

• A prioritised remediation plan. Each step explains what to change and shows the grade you could reach after completing that step and all preceding ones.
• A specific release recommendation. The report identifies a version that fixes the advisory on your release line, while respecting your chosen track.
• Explanations for failed checks. What was checked, why it matters and how to fix it, with a link to the relevant setting in the OpenCloud documentation.
• Exceptions for findings you accept. Waived findings remain visible but no longer limit the grade. A waiver applies only to a failed check and cannot change an end-of-life rating.

Run another scan after making changes to check which findings have been resolved.

Scope

What a good grade is not

An A+ means the checks used for the grade found no issue. It does not cover private files, the operating system, backups or account permissions. Use the report alongside those checks. See how the scan works for its scope and limits.