As Lulzsec so clumsily illustrated, you can't know because most vulnerabilities are silently patched, or undiscovered (but still in use without the site's knowledge.) Any such index would more likely penalize the most honest than the most vulnerable.