Cloud-Native Serverless Web Security Assessment: Coverage, Agreement, and Score Sensitivity

Preprint, Version 1.0. BRAVO6 is an Azure-hosted serverless system for externally observable web security assessment. This study presents an auditable reanalysis of an archived 864-domain experiment, distinguishing execution success, observation coverage, and measurement validity. The archive contains 848 result documents, including 508 representative-page responses and 497 module-complete representative results. Evidence-backed sensitivity analysis shows that removing unsupported TLS assertions and one incorrect advisory-version match changes the mean score of the representative cohort from 16.93 to 24.78 under the original scoring rubric. The study also identifies substantial observation gaps for HSTS and dependency analysis and evaluates saved cross-tool verdict agreement under explicit small-sample limitations. This manuscript is a preprint and has not yet undergone peer review.