Quick Notes104 words
Metrics and queries for security — quick notes
Security metrics — quick notes
| Metric | Signals |
|---|---|
| MTTR by severity | Whether findings actually get fixed |
| Findings by age | Whether a backlog is accumulating |
| New findings per release | Is the codebase getting safer? |
| Secret scanning alerts | Credentials reaching the repo |
| Dependency currency | Whether a patch is even mergeable |
- Age beats count: 50 findings under a week ≫ 5 findings two years old.
- Aggregate MTTR hides triage failure — split it by severity.
- Dependency currency is a leading indicator of future response time.