Free Verify scan · aaif-goose/goose

goose scores 76/100

Extensible open-source AI agent that runs locally.

Commit dd17bf2 · 132 controls · Oct 15, 2026 · Re-checked daily

Scanned with public access only. Customer results are never published.

Delivery controls score76

goose

42median 6886

Out of 100. Stronger than 84% of the 68 other assessed repositories.

Score

76/100

Rank 10 of 69 · median 68

Gaps

10 fewer than the median of 33

Critical

1 controls

1 root cause

Not visible

Needs admin access

What goose does wellDefault branch identifiedBranch strategy observableDefault branch protected by rulesetGitHub App bypass inventoryVisibility and ownership recorded

Gaps23

goose

15median 3361

Visible controls Verify found unmet. Fewer is better. Stronger than 87% of the 68 other assessed repositories.

How does your team compare?

This is what Canon Verify found in goose's public configuration. Your team's process probably has the same gaps. Most private repos do.

See how your team scores

5 minutes. No repository access needed.

Scan your own repo with Verify (free)

Analysis

Our read

Governance leads the assessment.

5 of 5 visible controls pass in governance.

Code quality has the most room to improve.

5 visible controls remain open in code quality.

Priority

Fix these first

critical

Required checks match workflow names

Covers 4 controls

Required checks match workflow names
Required status checks strict
Required check includes tests
Required lint check

What Verify read

Required checks: none

Risk: If required checks do not match the jobs that run, a rule appears to protect the branch while enforcing nothing.

text

Align required checks with jobs.

Have this gap too? Start from the Release Gate flow.

Open in Design

high

Workflow permissions least-privilege

Covers 1 control

Workflow permissions least-privilege

What Verify read

One or more workflows do not declare a permissions block.

Risk: Broadly permissioned workflows hand a write token to every action they call, including third-party code.

text

Set least-privilege GITHUB_TOKEN.

high

Code scanning configured

Covers 2 controls

Static analysis beyond lint
Code scanning configured

What Verify read

No code-scanning or static-analysis job was found in the workflows.

Risk: With no code scanning, known vulnerable patterns ship and are found by an attacker rather than the pipeline.

text

Enable code scanning.

Overview

Control map

Public-access limit

27 controls this scan couldn't read

This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.

Pull-request requirement on default branchcritical
Required reviewscritical
Human gate before mergecritical
Force-push restrictedhigh
Administrator bypass restrictedhigh
Tag protectionhigh
CODEOWNERS reviews requiredhigh
Stale reviews dismissedhigh
Last-push approval requiredhigh
Self-merge restrictedhigh
Bypass actors justifiedhigh
Push protection enabledhigh
Dependabot alertshigh
Secret scanning alertshigh
SAST required on default branchhigh
Environment secrets scopedhigh
Signed commits requiredmedium
Branch deletion protectedmedium
Conversation resolution requiredmedium
Merge queue or serialized mergemedium
Secret custodiansmedium
Agent identity in commitsmedium
Audit of agent actionsmedium
Audit of privileged actionsmedium
Linear history or documented merge methodlow
Private vulnerability reportinglow
Wait timer or freeze windowlow

Get Verify

Method

How Verify works

Read

Verify reads the repository at a pinned commit: settings, rulesets, workflows, and files.

Judge

Each control is checked against a written expectation. Same inspector, same criteria, every repository.

Prove

Every result shows the evidence Verify read. Assessments re-run daily, and changes are logged.

132 controls · 69 repositories assessed · re-run daily

	This free scan	Verify on your repository
Access	Public	GitHub App you install
Controls read	97 of 97	All 97
Private repositories	No	Yes
Results	Published here	Private to your organization

Evidence locker

Every control Verify checked

Review

16 of 26 pass

CI & tests

22 of 30 pass

Code quality

3 of 8 pass

Security

12 of 20 pass

Agents & AI

4 of 8 pass

Release & ops

8 of 22 pass

Docs

4 of 6 pass

Assessment timeline

Canon re-assesses this repository daily. An entry appears only when something changed — the score, a control's outcome, or a control ceasing to apply.

Sep 21 · 73Oct 15 · 76

Sep 30, 2026Delivery controls score 73 → 76ac15f93
Sep 30, 2026Action SHA pins · Security — gap → confirmedac15f93
Sep 30, 2026No mutable tags for release artifacts · Security — gap → confirmedac15f93
Sep 30, 2026Agent workflow permissions · Agents & AI — gap → confirmedac15f93
Sep 26, 2026SBOM or dependency graph · Security — needs repository admin access → confirmed04ed836
Sep 24, 2026SBOM or dependency graph · Security — confirmed → needs repository admin access80c1197
Sep 23, 2026SBOM or dependency graph · Security — needs repository admin access → confirmed201837d

Get this report for your own repository.

Canon Verify runs the same inspection on your private repo. Read-only GitHub App. First scan free.

Scan your repo free See how your team scores

Read-only access. No code stored. How Canon handles your data →

View aaif-goose/goose on GitHub

Maintain goose? If anything here is inaccurate or out of date, email security@strikelabs.co and we'll correct it.