Canon
All teardowns
argoproj logo

Free Verify scan · argoproj/argo-cd

argo-cd scores 77/100

GitOps continuous delivery for Kubernetes.

Commit 8833e45 · 132 controls · Oct 16, 2026 · Re-checked daily

Scanned with public access only. Customer results are never published.

Delivery controls score77
argo-cd
42median 6886

Out of 100. Stronger than 88% of the 68 other assessed repositories.

Score

77/100

Rank 9 of 69 · median 68

Gaps

22

11 fewer than the median of 33

Critical

4 controls

2 root causes

Not visible

27

Needs admin access

What argo-cd does wellDefault branch identifiedBranch strategy observableDefault branch protected by rulesetGitHub App bypass inventoryVisibility and ownership recorded
Gaps22
argo-cd
15median 3361

Visible controls Verify found unmet. Fewer is better. Stronger than 93% of the 68 other assessed repositories.

How does your team compare?

This is what Canon Verify found in argo-cd's public configuration. Your team's process probably has the same gaps. Most private repos do.

See how your team scores

5 minutes. No repository access needed.

Scan your own repo with Verify (free)

Analysis

Our read

01

Governance leads the assessment.

5 of 5 visible controls pass in governance.

02

Code quality has the most room to improve.

4 visible controls remain open in code quality.

Priority

Fix these first

critical

Production approvers named

Covers 3 controls
  • Production approvers named
  • Production protection
  • Production reviewers resolved

What Verify read

No resolved production reviewers.

Risk: Unnamed production approvers mean deployment approval falls to whoever is nearby when the button needs pressing.

text
Name production reviewers.

Have this gap too? Start from the PR Review Pipeline flow.

Open in Design
critical

Required checks match workflow names

Covers 4 controls
  • Required checks match workflow names
  • Required status checks strict
  • Required check includes tests
  • Required lint check

What Verify read

Required checks: none

Risk: If required checks do not match the jobs that run, a rule appears to protect the branch while enforcing nothing.

text
Align required checks with jobs.
high

Action SHA pins

Covers 1 control
  • Action SHA pins

What Verify read

At least one third-party action is referenced by tag or branch rather than a commit SHA.

Risk: Actions referenced by tag can be repointed at new code without changing a line in this repository.

text
Pin actions by SHA.

Overview

Control map

Public-access limit

27 controls this scan couldn't read

This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.

  • Pull-request requirement on default branchcritical
  • Required reviewscritical
  • Human gate before mergecritical
  • Force-push restrictedhigh
  • Administrator bypass restrictedhigh
  • Tag protectionhigh
  • CODEOWNERS reviews requiredhigh
  • Stale reviews dismissedhigh
  • Last-push approval requiredhigh
  • Self-merge restrictedhigh
  • Bypass actors justifiedhigh
  • Push protection enabledhigh
  • Dependabot alertshigh
  • Secret scanning alertshigh
  • SAST required on default branchhigh
  • Environment secrets scopedhigh
  • Signed commits requiredmedium
  • Branch deletion protectedmedium
  • Conversation resolution requiredmedium
  • Merge queue or serialized mergemedium
  • Secret custodiansmedium
  • Agent identity in commitsmedium
  • Audit of agent actionsmedium
  • Audit of privileged actionsmedium
  • Linear history or documented merge methodlow
  • Private vulnerability reportinglow
  • Wait timer or freeze windowlow
Get Verify

Method

How Verify works

01

Read

Verify reads the repository at a pinned commit: settings, rulesets, workflows, and files.

02

Judge

Each control is checked against a written expectation. Same inspector, same criteria, every repository.

03

Prove

Every result shows the evidence Verify read. Assessments re-run daily, and changes are logged.

132 controls · 69 repositories assessed · re-run daily

This free scanVerify on your repository
AccessPublicGitHub App you install
Controls read97 of 97All 97
Private repositoriesNoYes
ResultsPublished herePrivate to your organization

Evidence locker

Every control Verify checked

Review

15 of 26 pass

CI & tests

23 of 30 pass

Code quality

4 of 8 pass

Security

12 of 20 pass

Agents & AI

3 of 8 pass

Release & ops

8 of 22 pass

Docs

5 of 6 pass

Assessment timeline

Canon re-assesses this repository daily. An entry appears only when something changed — the score, a control's outcome, or a control ceasing to apply.

Sep 21 · 78Oct 16 · 77
  • Sep 30, 2026Delivery controls score 78 → 77896e70c
  • Sep 30, 2026Agent workflow permissions · Agents & AI — confirmed → gap896e70c
  • Sep 23, 2026SBOM or dependency graph · Security — needs repository admin access → confirmedfe9883d

Get this report for your own repository.

Canon Verify runs the same inspection on your private repo. Read-only GitHub App. First scan free.

Scan your repo freeSee how your team scores

Read-only access. No code stored. How Canon handles your data →

View argoproj/argo-cd on GitHub

Maintain argo-cd? If anything here is inaccurate or out of date, email security@strikelabs.co and we'll correct it.