# Criticality and Risk Analysis of werkkompass

The section "Required Checks" of [agentic-workflow.md](agentic-workflow.md) requires this document.
Only the human sets or changes the criticality.

## Criticality

**low**, set by the human on 2026-10-14, as a deviation from the table of the workflow (see below).

- werkkompass is one static HTML file, served by the web server of javagil.de.
- It has no server code, no dependencies, no forms and no requests to other hosts.
- It handles no data of users and no credentials; its state lives only in the open page.

So a known vulnerability of a dependency would fail the build from CVSS 9.

## What werkkompass Handles

- The texts and the model of the demo, all part of `index.html`.
- No cookies, no `localStorage`, no tracking.

## Who Reaches It

- Anyone on the internet reads the page at https://javagil.de/vibe-engineering.
- Only the human installs a new version, with `install-vibe-engineering-webapp` over SSH.

## What a Breach Would Cost

- A changed page on javagil.de, e.g. defaced, or with a script that attacks its visitors.
  That needs write access to the web server, which werkkompass does not grant.
- No data of users, no money, no other systems.

## Risks

| Risk | Measure |
|------|---------|
| a script or a resource from another host enters the page | no foreign scripts; a new one is a new dependency and needs the human's consent |
| a text rendered as HTML from input | the page renders only its own texts; review category `xss` |
| a link in a framed view leads to a page that refuses to be framed | `target="_top"` on such links; review |
| the installer deletes the checked-out `index.html` | README and AGENTS.md say to install a copy |

## Deviations from the Defaults of the Required Checks

- **Criticality low although reachable from the internet:**
  the table of the workflow rates a repository reachable from the internet as high.
  werkkompass is a static page without dependencies and without data of others,
  so a vulnerability cannot reach more than the page itself.
- **No checks of vulnerabilities and licenses yet:** there are no dependencies to check.
  The first dependency or build tool brings these checks along.
- **No mutation tests:** werkcrappit measures Kotlin and Java; werkkompass has neither.