Governance leads the assessment.
10 of 10 visible controls pass in governance.

Free Verify scan · vercel/next.js
The React framework for the web.
Commit a5fe506 · 132 controls · Oct 15, 2026 · Re-checked daily
Scanned with public access only. Customer results are never published.
Out of 100. Stronger than 63% of the 68 other assessed repositories.
Score
71/100
Rank 24 of 69 · median 68
Gaps
31
2 fewer than the median of 33
Critical
0 controls
0 root causes
Not visible
15
Needs admin access
Visible controls Verify found unmet. Fewer is better. Stronger than 56% of the 68 other assessed repositories.
This is what Canon Verify found in next.js's public configuration. Your team's process probably has the same gaps. Most private repos do.
5 minutes. No repository access needed.
Analysis
10 of 10 visible controls pass in governance.
8 visible controls remain open in security.
Priority
What Verify read
No tree evidence for owners.
Risk: With no ownership file, review lands on whoever is available rather than whoever understands the code.
Add CODEOWNERS.Have this gap too? Start from the PR Review Pipeline flow.
Open in DesignWhat Verify read
Dismiss stale: false
Risk: Approvals that survive a new push mean the merged code is not the code anyone approved.
Dismiss stale reviews.What Verify read
Last-push approval: false
Risk: A final push after approval can introduce anything, and the merge still shows a green review.
Require last-push approval.Overview
Public-access limit
This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.
Method
01
Verify reads the repository at a pinned commit: settings, rulesets, workflows, and files.
02
Each control is checked against a written expectation. Same inspector, same criteria, every repository.
03
Every result shows the evidence Verify read. Assessments re-run daily, and changes are logged.
132 controls · 69 repositories assessed · re-run daily
| This free scan | Verify on your repository | |
|---|---|---|
| Access | Public | GitHub App you install |
| Controls read | 107 of 107 | All 107 |
| Private repositories | No | Yes |
| Results | Published here | Private to your organization |
Evidence locker
Canon re-assesses this repository daily. An entry appears only when something changed — the score, a control's outcome, or a control ceasing to apply.
Canon Verify runs the same inspection on your private repo. Read-only GitHub App. First scan free.
Read-only access. No code stored. How Canon handles your data →
Maintain next.js? If anything here is inaccurate or out of date, email security@strikelabs.co and we'll correct it.