Scanned with public access only. Customer results are never published.
Delivery controls score86
zarf
42median 6886
Out of 100. Stronger than 100% of the 68 other assessed repositories.
Score
86/100
Rank 1 of 69 · median 68
Gaps
15
18 fewer than the median of 33
Critical
3 controls
1 root cause
Not visible
15
Needs admin access
What zarf does wellDefault branch identifiedBranch strategy observableDefault branch protected by rulesetForce-push restrictedPull-request requirement on default branch
Gaps15
zarf
15median 3361
Visible controls Verify found unmet. Fewer is better. Stronger than 100% of the 68 other assessed repositories.
How does your team compare?
This is what Canon Verify found in zarf's public configuration. Your team's process probably has the same gaps. Most private repos do.
At least one workflow grants write permissions at the top level or declares none.
Risk: A write-by-default token lets any compromised action push code or publish a release.
text
Set default workflow permissions to read.
high
Agent write paths constrained
Covers 1 control
Agent write paths constrained
What Verify read
No tree evidence for agent_guardrails.
Risk: An unconstrained agent can write to release, infrastructure, or credential files unattended.
text
Constrain agent write paths.
Overview
Control map
Public-access limit
15 controls this scan couldn't read
This free scan used public access only. These controls live in settings only a repository admin can read. Verify checks them on your connected repository.
