A credential in an href leaks into browser history, server logs, and the Referer header sent to the destination site. It is exposed the moment the page is rendered, not the moment the link is clicked.
Impact is importance multiplied by the confidence tier’s weight — SPECIFICATION 1.0, RESEARCH 0.7, EMERGING 0.3, EXPERIMENTAL 0.1. Two rules backed by the same class of evidence therefore always carry the same weight, which is what makes the score reproducible rather than hand-tuned.