Free Verify scan · ossf/scorecard

scorecard scores 70/100

Automated security health checks for open-source projects.

Commit a1fe90a · 132 controls · Oct 15, 2026 · Re-checked daily

Scanned with public access only. Customer results are never published.

Delivery controls score70

scorecard

42median 6886

Out of 100. Stronger than 60% of the 68 other assessed repositories.

Score

70/100

Rank 27 of 69 · median 68

Gaps

2 fewer than the median of 33

Critical

3 controls

1 root cause

Not visible

Needs admin access

What scorecard does wellDefault branch identifiedBranch strategy observableDefault branch protected by rulesetForce-push restrictedPull-request requirement on default branch

Gaps31

scorecard

15median 3361

Visible controls Verify found unmet. Fewer is better. Stronger than 56% of the 68 other assessed repositories.

How does your team compare?

This is what Canon Verify found in scorecard's public configuration. Your team's process probably has the same gaps. Most private repos do.

See how your team scores

5 minutes. No repository access needed.

Scan your own repo with Verify (free)

Analysis

Our read

Governance leads the assessment.

9 of 10 visible controls pass in governance.

Agents & AI has the most room to improve.

1 visible control remain open in agents & ai.

Priority

Fix these first

critical

Production approvers named

Covers 3 controls

Production approvers named
Production protection
Production reviewers resolved

What Verify read

No resolved production reviewers.

Risk: Unnamed production approvers mean deployment approval falls to whoever is nearby when the button needs pressing.

text

Name production reviewers.

Have this gap too? Start from the PR Review Pipeline flow.

Open in Design

high

CODEOWNERS reviews required

Covers 1 control

CODEOWNERS reviews required

What Verify read

Code-owner reviews: false

Risk: Without required code-owner review, a change to a sensitive area can be approved by someone unfamiliar with it.

text

Require code-owner review.

high

Stale reviews dismissed

Covers 1 control

Stale reviews dismissed

What Verify read

Dismiss stale: false

Risk: Approvals that survive a new push mean the merged code is not the code anyone approved.

text

Dismiss stale reviews.

Overview

Control map

Public-access limit

13 controls this scan couldn't read

This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.

Administrator bypass restrictedhigh
Tag protectionhigh
Self-merge restrictedhigh
Bypass actors justifiedhigh
Push protection enabledhigh
Dependabot alertshigh
Secret scanning alertshigh
SAST required on default branchhigh
Environment secrets scopedhigh
Secret custodiansmedium
Audit of privileged actionsmedium
Private vulnerability reportinglow
Wait timer or freeze windowlow

Get Verify

Method

How Verify works

Read

Verify reads the repository at a pinned commit: settings, rulesets, workflows, and files.

Judge

Each control is checked against a written expectation. Same inspector, same criteria, every repository.

Prove

Every result shows the evidence Verify read. Assessments re-run daily, and changes are logged.

132 controls · 69 repositories assessed · re-run daily

	This free scan	Verify on your repository
Access	Public	GitHub App you install
Controls read	103 of 103	All 103
Private repositories	No	Yes
Results	Published here	Private to your organization

Evidence locker

Every control Verify checked

Governance

9 of 12 pass

Review

17 of 26 pass

CI & tests

21 of 30 pass

Code quality

3 of 8 pass

Security

11 of 20 pass

Agents & AI

0 of 8 pass

Release & ops

7 of 22 pass

Docs

4 of 6 pass

Assessment timeline

Canon re-assesses this repository daily. An entry appears only when something changed — the score, a control's outcome, or a control ceasing to apply.

Sep 21 · 66Oct 15 · 70

Sep 29, 2026Delivery controls score 66 → 70ac4b584
Sep 29, 2026Force-push restricted · Governance — needs repository admin access → confirmedac4b584
Sep 29, 2026Pull-request requirement on default branch · Governance — needs repository admin access → confirmedac4b584
Sep 29, 2026GitHub App bypass inventory · Governance — gap → confirmedac4b584
Sep 29, 2026Signed commits required · Governance — needs repository admin access → gapac4b584
Sep 29, 2026Branch deletion protected · Governance — needs repository admin access → confirmedac4b584
Sep 29, 2026Linear history or documented merge method · Governance — needs repository admin access → confirmedac4b584
Sep 29, 2026Required reviews · Review — needs repository admin access → confirmedac4b584
Sep 29, 2026CODEOWNERS reviews required · Review — needs repository admin access → gapac4b584
Sep 29, 2026Stale reviews dismissed · Review — needs repository admin access → gapac4b584
Sep 29, 2026Last-push approval required · Review — needs repository admin access → gapac4b584
Sep 29, 2026Conversation resolution required · Review — needs repository admin access → confirmedac4b584
Sep 29, 2026Merge queue or serialized merge · Review — needs repository admin access → gapac4b584
Sep 29, 2026Required checks match workflow names · CI & tests — gap → confirmedac4b584
Sep 29, 2026Required status checks strict · CI & tests — gap → confirmedac4b584
Sep 29, 2026Required check includes tests · CI & tests — gap → confirmedac4b584
Sep 29, 2026Required lint check · Code quality — gap → confirmedac4b584

Get this report for your own repository.

Canon Verify runs the same inspection on your private repo. Read-only GitHub App. First scan free.

Scan your repo free See how your team scores

Read-only access. No code stored. How Canon handles your data →

View ossf/scorecard on GitHub

Maintain scorecard? If anything here is inaccurate or out of date, email security@strikelabs.co and we'll correct it.