> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iriscode.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Custom Scoring Weights: Tune the Health Score for Your Team

> Control how much each finding deducts from the health score via healthScoreWeights in .irisconfig.json. Amplify secrets, zero out noise. Requires Iris Code Pro.

Every file starts at 100 and loses points as findings are added. A secret costs 10, a warning costs 3, and so on.

Those defaults represent a judgement about what matters most, and yours may differ. A team publishing a public API might weight a missing return type more heavily than 2. A security-focused team might want a single `eval` to be enough to fail a file on its own. `healthScoreWeights` is how you express that.

<Note>
  Custom weights are Pro. Set `healthScoreWeights` in `.irisconfig.json`, or configure it visually in [Config Studio](/configuration/config-studio) under Custom Scoring.
</Note>

## What everything costs by default

Leave a key out and you get the active preset's value for it, or the global default below if you haven't set a preset.

| Key                       | Default | What it penalises                                                                                             |
| ------------------------- | ------- | ------------------------------------------------------------------------------------------------------------- |
| `hardcodedSecret`         | `10`    | Per hardcoded secret found - largest single deduction                                                         |
| `disabledTlsVerification` | `7`     | Per disabled-TLS-verification finding                                                                         |
| `openRedirect`            | `7`     | Per open-redirect finding                                                                                     |
| `errorWarning`            | `5`     | Per error-severity structural warning                                                                         |
| `evalUsage`               | `5`     | Per eval() / exec() finding                                                                                   |
| `sqlConcatenation`        | `5`     | Per SQL-built-by-concatenation finding                                                                        |
| `weakHashing`             | `5`     | Per weak-hashing (MD5/SHA-1) finding                                                                          |
| `warningWarning`          | `3`     | Per warning-severity structural warning                                                                       |
| `tsIgnore`                | `3`     | Per `@ts-ignore` comment (TS/JS only)                                                                         |
| `unsafeRegex`             | `3`     | Per ReDoS-prone regex finding                                                                                 |
| `duplicateCode`           | `3`     | Per duplicate code block found in the file                                                                    |
| `anyUsage`                | `2`     | Per explicit `any` type (TS/JS only)                                                                          |
| `deepNesting`             | `2`     | Multiplier applied to deep nesting score per function                                                         |
| `unusedFunction`          | `2`     | Per unused function definition                                                                                |
| `insecureRandom`          | `2`     | Per insecure-RNG finding                                                                                      |
| `debugFlagsEnabled`       | `2`     | Per debug-flag-enabled finding                                                                                |
| `bareSuppression`         | `2`     | Per bare `iris-ignore` comment - a suppression directive missing its required reason, or naming no valid rule |
| `consoleLog`              | `1`     | Per console/debug print statement                                                                             |
| `longParamList`           | `1`     | Per long parameter list finding                                                                               |
| `unusedVar`               | `1`     | Per unused variable                                                                                           |
| `hardcodedLocalhost`      | `1`     | Per hardcoded-localhost-URL finding                                                                           |

<Note>
  The nine security smell keys (`evalUsage`, `sqlConcatenation`, `insecureRandom`, `unsafeRegex`, `hardcodedLocalhost`, `disabledTlsVerification`, `debugFlagsEnabled`, `weakHashing`, `openRedirect`) were added alongside [Security Smells](/features/security-smells) detection. The `bareSuppression` key was added alongside [Inline Suppressions](/enforcement/suppressions) - a valid, reasoned suppression costs nothing, but a bare one is itself a finding. The `duplicateCode` key was added alongside [Duplicate Code Detection](/features/duplicate-detection).
</Note>

## When to customise weights

* Your team ships to a **regulated environment** and wants secrets to cost twice the default - set `"hardcodedSecret": 18`.
* Your codebase is a **prototype** and left-in console logs are not a blocker - set `"consoleLog": 0`.
* **TypeScript safety** is the team's top concern - bump `anyUsage` and `tsIgnore` above their preset values.
* You want the health score to reflect only the findings you actually act on - **zero out the noise**.

## Security-focused example

Amplify the secrets penalty and make console logs carry more weight for audit-ready code:

```json .irisconfig.json theme={null}
{
  "presetId": "security",
  "healthScoreWeights": {
    "hardcodedSecret": 18,
    "consoleLog": 3,
    "anyUsage": 2
  }
}
```

## Softening noise for a legacy codebase

Zero out findings your team has accepted as-is so the health score reflects only what you plan to fix:

```json .irisconfig.json theme={null}
{
  "presetId": "balanced",
  "healthScoreWeights": {
    "consoleLog": 0,
    "unusedVar": 0,
    "unusedFunction": 0
  }
}
```

<Warning>
  Setting a weight to `0` means that finding type does **not** affect the health score at all - it still shows in the sidebar and still fires inline diagnostics if enabled, but it contributes nothing to the 0–100 number. Use this intentionally.
</Warning>

## Interaction with presets

When a `presetId` is active, the preset's own weight values are the base. Any key you specify in `healthScoreWeights` overrides only that key - omitted keys inherit the preset's value. If you have no preset and no custom weights, the global defaults in the table above apply.

## Configuring via Config Studio

Open [Account → Config](https://www.iriscode.co/account/config), switch to **Custom** mode, then expand the **Custom scoring** accordion. Each weight field shows the current preset default next to the input - you only need to touch the keys you want to change. Click **Sync to VS Code** when done; only the non-default keys are written to the config file.