Skip to main content
Every file starts at 100 and loses points as findings are added. A secret costs 10, a warning costs 3, and so on. Those defaults represent a judgement about what matters most, and yours may differ. A team publishing a public API might weight a missing return type more heavily than 2. A security-focused team might want a single eval to be enough to fail a file on its own. healthScoreWeights is how you express that.
Custom weights are Pro. Set healthScoreWeights in .irisconfig.json, or configure it visually in Config Studio under Custom Scoring.

​
What everything costs by default

Leave a key out and you get the active preset’s value for it, or the global default below if you haven’t set a preset.
The nine security smell keys (evalUsage, sqlConcatenation, insecureRandom, unsafeRegex, hardcodedLocalhost, disabledTlsVerification, debugFlagsEnabled, weakHashing, openRedirect) were added alongside Security Smells detection. The bareSuppression key was added alongside Inline Suppressions - a valid, reasoned suppression costs nothing, but a bare one is itself a finding. The duplicateCode key was added alongside Duplicate Code Detection.

​
When to customise weights

  • Your team ships to a regulated environment and wants secrets to cost twice the default - set "hardcodedSecret": 18.
  • Your codebase is a prototype and left-in console logs are not a blocker - set "consoleLog": 0.
  • TypeScript safety is the team’s top concern - bump anyUsage and tsIgnore above their preset values.
  • You want the health score to reflect only the findings you actually act on - zero out the noise.

​
Security-focused example

Amplify the secrets penalty and make console logs carry more weight for audit-ready code:
.irisconfig.json

​
Softening noise for a legacy codebase

Zero out findings your team has accepted as-is so the health score reflects only what you plan to fix:
.irisconfig.json
Setting a weight to 0 means that finding type does not affect the health score at all - it still shows in the sidebar and still fires inline diagnostics if enabled, but it contributes nothing to the 0–100 number. Use this intentionally.

​
Interaction with presets

When a presetId is active, the preset’s own weight values are the base. Any key you specify in healthScoreWeights overrides only that key - omitted keys inherit the preset’s value. If you have no preset and no custom weights, the global defaults in the table above apply.

​
Configuring via Config Studio

Open Account → Config, switch to Custom mode, then expand the Custom scoring accordion. Each weight field shows the current preset default next to the input - you only need to touch the keys you want to change. Click Sync to VS Code when done; only the non-default keys are written to the config file.