Most of a concept’s risk is invisible to the naked eye.
Under the glossary sits a typed knowledge graph. Every concept carries a four-axis
DEBT score; every relationship is a typed edge that can carry risk forward.
The engine walks those edges — bounded to 3 hops,
decaying 0.5 per step — to surface
the structural risk no single page reveals on its own.
LIVE DATA PREVIEW · CURRENT TOP RISK
regex_syntaxTrap axis
What the eye sees
0
direct dependencies, 1 hop
→
What the engine sees
5.92
full propagation · 100% of it hidden
100% of this concept’s computed risk
— +5.92 on the Trap axis
— is inherited from concepts two and three hops away, invisible to direct inspection.
Auto-selected as the highest-exposure concept right now · explore any concept yourself in section 03 ↓
3-hop traversaldecay 0.5 / stepaxis cap 10readiness 40% · Foundation solidsnapshot 2026-07-14
The two reads either agree or pull apart, and the disagreement is the signal. No invented score — each verdict is a call over reach (structure) and whether the axes diverge (DEBT). Three worked examples:
Reaches 27 downstream concepts, but its four axes collapse — one number captures the cost. Triage by reach; the fix is unlikely to need the full vector.
Raw content is one thing; relational depth is another. The engine’s value lives
in the edges — how densely the concepts are wired, and how much of that wiring
actually transmits risk.
1,519
Graph nodes
100% DEBT-scored
819
Live typed edges
623 risk · 196 neutral
76%
Risk-edge density
edges that carry risk
13/13
Risk verbs in use
full risk vocabulary active
359
Terms that spread risk
24% of the graph
369
Terms that inherit risk
24% downstream-exposed
29
Deepest reach (hops out)
80 hubs · avg 0.78
21/21
Verb weights synced
every vocab verb weighted
High-risk concepts wired into the graph
479 of 1,196 connected
2026-06-13 · 27%readiness over time ↗2026-07-14 · 40%
Total propagated risk by DEBT axis — Detectability, Effort, Burden, Trap
Detectability
138.1
how visible it is
Effort
174.2
cost to fix
Burden
462.9
cost to live with
Trap
583.7
how easily it misleads
Built for machines too
The underlying graph is published as structured flat-file JSON with typed edges — designed for
programmatic agent ingestion and retrieval-augmented grounding (RAG), not just human reading.
02 / RISK CORRIDORS
How risk travels between domains
A vulnerability in one technology rarely stays put. Following typed edges, the engine
traces corridors where risk crosses from one software domain into another — weakening
by 0.5 each hop, but still arriving.
Risk from accessibility_aria still reaches accessible_forms
2 hops away — at about 25% strength after decay.
One hub, both directions — refactor it and the whole ripple shifts
Feeds risk in
xml_signature_wrapping
oauth_vulnerabilities
cache_poisoning
+7 more
→account_takeover→
Its risk reaches
attack_chain
03 / WHERE TO LOOK
Two reads on the same graph
The same propagation graph answers two different questions. Structure tells you where damage concentrates — trust it first. DEBT-weighting tells you what kind of cost it is — reach for it once structure has put you at a hotspot.
Structure → where · audit
Pure graph reach, DEBT-independent. The strongest single signal across the propagation-dominated majority of a codebase, and it stays trustworthy where the four axes collapse. Triage with it — and let it gate the next read.
DEBT-weighting → what · prepare
The four-axis cost layered on that structure. It earns its keep only where damage factorizes — independent error modes, cost varying separately from wrongness. At a hotspot, it tells you which fix to spend.
Most load-bearing concept
php_ini
reaches 30 downstream concepts, up to 3 hops out.
Decayed reach 9.625 — closer dependencies weigh more. No DEBT magnitudes here: this ranking is pure structure, the signal you can trust even where the axes collapse.
For each concept, the engine compares what a developer sees from its direct dependencies against the full propagated exposure. The wider the gap, the more risk hides upstream — biggest blind spots first.
04 / METHOD
How the engine works
The engine is deliberately simple to reason about. Here is every moving part, in plain terms.
The exact weights and parameters are tuned internally — but the mechanics below are the
whole story.
Propagation
Risk doesn’t stay in one concept. The engine follows typed relationships outward, letting a concept’s risk flow to the concepts it connects to. It walks the graph a bounded number of hops, so every score reflects a concept and its neighbourhood, not just itself.
Weighting
Not every relationship carries risk the same way — a “causes” edge transmits far more than a loose “often seen with.” Each relationship type carries a calibrated weight that decides how much risk crosses it, so the graph reflects how software actually fails, not just how concepts happen to be linked.
Decay
Risk fades with distance. Each hop counts for less than the one before, so a direct dependency weighs more than something three steps away. This keeps far-flung connections from dominating and anchors every score to what’s actually close.
Normalization
Scores are scaled to a common range so different axes and different concepts compare on equal footing. A number means the same thing whether you’re looking at one concept or the next.
Caps
Accumulated risk is bounded. No matter how many paths feed into a concept, its score can’t run away — a ceiling keeps results stable, comparable, and readable instead of compounding without limit.
Readiness
A coverage measure, not a risk score: how much of the high-risk graph is actually wired into the propagation model. Low readiness means the engine can only see part of the picture; as more risk-bearing relationships are added, readiness climbs and the model sees more.
Verb ontology
Every relationship is one of a controlled set of typed verbs — causes, requires, contains, configures, and so on. The vocabulary is the contract: it decides which relationships transmit risk, and in which direction. Nothing propagates that isn’t an explicit, typed edge.
The specific weights, decay factor and caps are part of the model’s calibration and kept internal.
Everything above is the full set of moving parts — nothing is hidden in how it reasons,
only in how it’s tuned.
05 / GUESTBOOK
Who’s been reading the graph
AI agents and crawlers that fetched this page, matched by User-Agent against known
bot patterns. Last 30 days. No personal data stored — just
the machines that came to read.
