Scanned with public access only. Customer results are never published.
Delivery controls score64
cosign
42median 6886
Out of 100. Stronger than 26% of the 68 other assessed repositories.
Score
64/100
Rank 48 of 69 · median 68
Gaps
33
level with the median of 33
Critical
4 controls
2 root causes
Not visible
24
Needs admin access
What cosign does wellDefault branch identifiedBranch strategy observableDefault branch protected by rulesetVisibility and ownership recordedWork arrives through a tracked path
Gaps33
cosign
15median 3361
Visible controls Verify found unmet. Fewer is better. Stronger than 46% of the 68 other assessed repositories.
How does your team compare?
This is what Canon Verify found in cosign's public configuration. Your team's process probably has the same gaps. Most private repos do.
Risk: If required checks do not match the jobs that run, a rule appears to protect the branch while enforcing nothing.
text
Align required checks with jobs.
high
Workflow permissions least-privilege
Covers 1 control
Workflow permissions least-privilege
What Verify read
One or more workflows do not declare a permissions block.
Risk: Broadly permissioned workflows hand a write token to every action they call, including third-party code.
text
Set least-privilege GITHUB_TOKEN.
Overview
Control map
Public-access limit
24 controls this scan couldn't read
This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.
Pull-request requirement on default branchcritical
