Scanned with public access only. Customer results are never published.
Delivery controls score83
gemini-cli
42median 6886
Out of 100. Stronger than 99% of the 68 other assessed repositories.
Score
83/100
Rank 2 of 69 · median 68
Gaps
19
14 fewer than the median of 33
Critical
0 controls
0 root causes
Not visible
15
Needs admin access
What gemini-cli does wellDefault branch identifiedBranch strategy observableDefault branch protected by rulesetForce-push restrictedPull-request requirement on default branch
Gaps19
gemini-cli
15median 3361
Visible controls Verify found unmet. Fewer is better. Stronger than 99% of the 68 other assessed repositories.
How does your team compare?
This is what Canon Verify found in gemini-cli's public configuration. Your team's process probably has the same gaps. Most private repos do.
Risk: A final push after approval can introduce anything, and the merge still shows a green review.
text
Require last-push approval.
high
Workflow permissions least-privilege
Covers 1 control
Workflow permissions least-privilege
What Verify read
One or more workflows do not declare a permissions block.
Risk: Broadly permissioned workflows hand a write token to every action they call, including third-party code.
text
Set least-privilege GITHUB_TOKEN.
Overview
Control map
Public-access limit
15 controls this scan couldn't read
This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.
