How about positives too, like "uses best practises for updates", "uses appropriate authentication and authorisation for its function", "uses a reasonable amount of power" etc