Read the explanation
The defensive risk page assigns thirty five points each to credential access and autonomous publishing, fifteen to dependency resolution, ten to package querying and five per autonomy level. With all permissions and level four the raw total is one hundred fifteen, capped at one hundred. Bars span two hundred thirty and two hundred pixels at two pixels per point. An exact default RubyGems branch bypasses that general calculation and writes critical risk, twelve compromised packages and fourteen hundred twenty exposed endpoints directly. Those are illustrative fixture outputs, not observations of actual registry compromises or validated likelihood. Source incident allegations and named services are not independently verified in this local diagnostic. Keeping all permissions while enabling sandbox and quarantine subtracts forty five and thirty five from raw one hundred fifteen, leaving thirty five and the guarded branch. The strict mitigation button also disables credential access and publishing, removing another seventy, so raw score becomes negative thirty five and clamps to the minimum five. Bars span one hundred forty and twenty at four pixels per guarded and strict score. The button therefore does more than deduct eighty points. Both branches assign zero packages and zero endpoints; that is the rubric result rather than proof of containment. Native checkboxes change local state only and do not install a sandbox, revoke credentials or quarantine real packages. Risk thresholds select discrete captions and counts. Scores at seventy or higher use a critical branch, forty through sixty nine elevated, and below forty guarded. Switching to guarded changes the package caption from twelve to zero in this illustrative scenario, represented by two hundred sixteen and zero pixels at eighteen per caption count. These outputs are categorical assignments rather than a continuous exposure estimator. The source updates metrics and narrative before calling its D3 graph, so missing D3 leaves the updated DOM and native controls despite a graph error. Actual JSON and text exports can record the canonical booleans and assigned results. No simulated breach label, zero caption or exported brief establishes real-world vulnerability, external incident accuracy, actual mitigation or public deployment.