Free Verify scan · stablyai/orca

orca scores 68/100

Desktop orchestrator for running CLI coding agents in parallel.

Commit 7005af3 · 132 controls · Oct 16, 2026 · Re-checked daily

Scanned with public access only. Customer results are never published.

Delivery controls score68

orca

42median 6886

Out of 100. Stronger than 43% of the 68 other assessed repositories.

Score

68/100

Rank 33 of 69 · median 68

Gaps

2 more than the median of 33

Critical

4 controls

2 root causes

Not visible

Needs admin access

What orca does wellDefault branch identifiedBranch strategy observableDefault branch protected by rulesetGitHub App bypass inventoryVisibility and ownership recorded

Gaps35

orca

15median 3361

Visible controls Verify found unmet. Fewer is better. Stronger than 34% of the 68 other assessed repositories.

How does your team compare?

This is what Canon Verify found in orca's public configuration. Your team's process probably has the same gaps. Most private repos do.

See how your team scores

5 minutes. No repository access needed.

Scan your own repo with Verify (free)

Analysis

Our read

CI & tests leads the assessment.

25 of 29 visible controls pass in ci & tests.

Security has the most room to improve.

8 visible controls remain open in security.

Priority

Fix these first

critical

Pull-request requirement on default branch

Covers 3 controls

Pull-request requirement on default branch
Required reviews
Human gate before merge

What Verify read

Required reviews: 0

Risk: Direct commits to the default branch ship unreviewed code, so no second person ever sees the change.

text

Require pull requests.

Have this gap too? Start from the PR Review Pipeline flow.

Open in Design

critical

Required checks match workflow names

Covers 4 controls

Required checks match workflow names
Required status checks strict
Required check includes tests
Required lint check

What Verify read

Required checks: none

Risk: If required checks do not match the jobs that run, a rule appears to protect the branch while enforcing nothing.

text

Align required checks with jobs.

high

Force-push restricted

Covers 1 control

Force-push restricted

What Verify read

Force-push allowed: true

Risk: A force push rewrites shared history, destroying the audit trail and any reviewed commit an incident later depends on.

text

Forbid force-push on main.

Overview

Control map

Public-access limit

15 controls this scan couldn't read

This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.

Administrator bypass restrictedhigh
Tag protectionhigh
Self-merge restrictedhigh
Bypass actors justifiedhigh
Push protection enabledhigh
Dependabot alertshigh
Secret scanning alertshigh
SAST required on default branchhigh
Environment secrets scopedhigh
Secret custodiansmedium
Agent identity in commitsmedium
Audit of agent actionsmedium
Audit of privileged actionsmedium
Private vulnerability reportinglow
Wait timer or freeze windowlow

Get Verify

Method

How Verify works

Read

Verify reads the repository at a pinned commit: settings, rulesets, workflows, and files.

Judge

Each control is checked against a written expectation. Same inspector, same criteria, every repository.

Prove

Every result shows the evidence Verify read. Assessments re-run daily, and changes are logged.

132 controls · 69 repositories assessed · re-run daily

	This free scan	Verify on your repository
Access	Public	GitHub App you install
Controls read	109 of 109	All 109
Private repositories	No	Yes
Results	Published here	Private to your organization

Evidence locker

Every control Verify checked

Governance

5 of 12 pass

Review

14 of 26 pass

CI & tests

25 of 30 pass

Code quality

4 of 8 pass

Security

6 of 20 pass

Agents & AI

4 of 8 pass

Release & ops

11 of 22 pass

Docs

5 of 6 pass

Assessment timeline

Canon re-assesses this repository daily. An entry appears only when something changed — the score, a control's outcome, or a control ceasing to apply.

Sep 21 · 66Oct 16 · 68

Oct 16, 2026Delivery controls score 71 → 687005af3
Oct 16, 2026Force-push restricted · Governance — confirmed → gap7005af3
Oct 16, 2026Branch deletion protected · Governance — confirmed → gap7005af3
Oct 16, 2026Conversation resolution required · Review — confirmed → gap7005af3
Oct 14, 2026Delivery controls score 66 → 711c274cc
Oct 14, 2026Default branch protected by ruleset · Governance — gap → confirmed1c274cc
Oct 14, 2026Force-push restricted · Governance — gap → confirmed1c274cc
Oct 14, 2026GitHub App bypass inventory · Governance — gap → confirmed1c274cc
Oct 14, 2026Branch deletion protected · Governance — gap → confirmed1c274cc
Oct 14, 2026Conversation resolution required · Review — gap → confirmed1c274cc
Oct 9, 2026Delivery controls score 67 → 66d7e985c
Oct 9, 2026Threat or trust notes for agents · Docs — confirmed → gapd7e985c
Oct 4, 2026Delivery controls score 66 → 67ce07786
Oct 4, 2026Agent workflow permissions · Agents & AI — gap → confirmedce07786

Get this report for your own repository.

Canon Verify runs the same inspection on your private repo. Read-only GitHub App. First scan free.

Scan your repo free See how your team scores

Read-only access. No code stored. How Canon handles your data →

View stablyai/orca on GitHub

Maintain orca? If anything here is inaccurate or out of date, email security@strikelabs.co and we'll correct it.