Free Verify scan · ruvnet/ruflo

ruflo scores 60/100

Claude Code plugins/MCP for multi-agent swarms, memory, and loops.

Commit 1882006 · 132 controls · Oct 16, 2026 · Re-checked daily

Scanned with public access only. Customer results are never published.

Delivery controls score60

ruflo

42median 6886

Out of 100. Stronger than 16% of the 68 other assessed repositories.

Score

60/100

Rank 56 of 69 · median 68

Gaps

10 more than the median of 33

Critical

8 controls

4 root causes

Not visible

Needs admin access

What ruflo does wellDefault branch identifiedBranch strategy observableVisibility and ownership recordedWork arrives through a tracked pathIssue templates present

Gaps43

ruflo

15median 3361

Visible controls Verify found unmet. Fewer is better. Stronger than 12% of the 68 other assessed repositories.

How does your team compare?

This is what Canon Verify found in ruflo's public configuration. Your team's process probably has the same gaps. Most private repos do.

See how your team scores

5 minutes. No repository access needed.

Scan your own repo with Verify (free)

Analysis

Our read

Docs leads the assessment.

6 of 6 visible controls pass in docs.

Governance has the most room to improve.

7 visible controls remain open in governance.

Priority

Fix these first

critical

Default branch protected by ruleset

Covers 1 control

Default branch protected by ruleset

What Verify read

No ruleset or protection on the default branch.

Risk: An unprotected default branch can be written to directly, so a single mistaken push skips review entirely.

text

Protect the default branch with a ruleset.

Have this gap too? Start from the PR Review Pipeline flow.

Open in Design

critical

Pull-request requirement on default branch

Covers 3 controls

Pull-request requirement on default branch
Required reviews
Human gate before merge

What Verify read

Required reviews: 0

Risk: Direct commits to the default branch ship unreviewed code, so no second person ever sees the change.

text

Require pull requests.

critical

Production approvers named

Covers 3 controls

Production approvers named
Production protection
Production reviewers resolved

What Verify read

No resolved production reviewers.

Risk: Unnamed production approvers mean deployment approval falls to whoever is nearby when the button needs pressing.

text

Name production reviewers.

Overview

Control map

Public-access limit

16 controls this scan couldn't read

This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.

Administrator bypass restrictedhigh
Tag protectionhigh
Self-merge restrictedhigh
Bypass actors justifiedhigh
Push protection enabledhigh
Dependabot alertshigh
Secret scanning alertshigh
SAST required on default branchhigh
Environment secrets scopedhigh
Secret custodiansmedium
SBOM or dependency graphmedium
Agent identity in commitsmedium
Audit of agent actionsmedium
Audit of privileged actionsmedium
Private vulnerability reportinglow
Wait timer or freeze windowlow

Get Verify

Method

How Verify works

Read

Verify reads the repository at a pinned commit: settings, rulesets, workflows, and files.

Judge

Each control is checked against a written expectation. Same inspector, same criteria, every repository.

Prove

Every result shows the evidence Verify read. Assessments re-run daily, and changes are logged.

132 controls · 69 repositories assessed · re-run daily

	This free scan	Verify on your repository
Access	Public	GitHub App you install
Controls read	108 of 108	All 108
Private repositories	No	Yes
Results	Published here	Private to your organization

Evidence locker

Every control Verify checked

Governance

3 of 12 pass

Review

12 of 26 pass

CI & tests

23 of 30 pass

Code quality

3 of 8 pass

Security

7 of 20 pass

Agents & AI

4 of 8 pass

Release & ops

7 of 22 pass

Assessment timeline

Canon re-assesses this repository daily. An entry appears only when something changed — the score, a control's outcome, or a control ceasing to apply.

Sep 21 · 61Oct 16 · 60

Oct 13, 2026Delivery controls score 59 → 6055e2c90
Oct 13, 2026E2E or integration tests · CI & tests — gap → confirmed55e2c90
Sep 30, 2026Migration files exist · Release & ops — confirmed → not applicable49da6ec
Sep 30, 2026Migrations reviewed · Release & ops — confirmed → not applicable49da6ec
Sep 30, 2026No unattended prod migration · Release & ops — needs repository admin access → not applicable49da6ec
Sep 30, 2026Delivery controls score 61 → 5949da6ec
Sep 30, 2026Schema change tests · Release & ops — confirmed → not applicable49da6ec
Sep 30, 2026Expand/contract documented · Release & ops — confirmed → not applicable49da6ec
Sep 30, 2026Backup or restore note · Release & ops — gap → not applicable49da6ec
Sep 30, 2026Migration tests · CI & tests — confirmed → not applicable49da6ec

Get this report for your own repository.

Canon Verify runs the same inspection on your private repo. Read-only GitHub App. First scan free.

Scan your repo free See how your team scores

Read-only access. No code stored. How Canon handles your data →

View ruvnet/ruflo on GitHub

Maintain ruflo? If anything here is inaccurate or out of date, email security@strikelabs.co and we'll correct it.