Cross-Border Stablecoin Register (CBSR)

Projects that follow the best practices below can voluntarily self-certify and show that they've achieved an Open Source Security Foundation (OpenSSF) best practices badge.

There is no set of practices that can guarantee that software will never have defects or vulnerabilities; even formal methods can fail if the specifications or assumptions are wrong. Nor is there any set of practices that can guarantee that a project will sustain a healthy and well-functioning development community. However, following best practices can help improve the results of projects. For example, some practices enable multi-person review before release, which can both help find otherwise hard-to-find technical vulnerabilities and help build trust and a desire for repeated interaction among developers from different companies. To earn a badge, all MUST and MUST NOT criteria must be met, all SHOULD criteria must be met OR be unmet with justification, and all SUGGESTED criteria must be met OR unmet (we want them considered at least). If you want to enter justification text as a generic comment, instead of being a rationale that the situation is acceptable, start the text block with '//' followed by a space. Feedback is welcome via the GitHub site as issues or pull requests There is also a mailing list for general discussion.

We gladly provide the information in several locales, however, if there is any conflict or inconsistency between the translations, the English version is the authoritative version.
If this is your project, please show your badge status on your project page! The badge status looks like this: Badge level for project 14172 is silver Here is how to embed it:
You can show your badge status by embedding this in your markdown file:
[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/14172/badge)](https://www.bestpractices.dev/projects/14172)
or by embedding this in your HTML:
<a href="https://www.bestpractices.dev/projects/14172"><img src="https://www.bestpractices.dev/projects/14172/badge"></a>


These are the Silver level criteria. You can also view the Passing or Gold level criteria.

Baseline Series: Baseline Level 1 Baseline Level 2 Baseline Level 3

        

 Basics 17/17 ●

  • General

    Note that other projects may use the same name.

    CBSR is an open, versioned, machine-readable register of stablecoin regulation across twelve jurisdictions, with a deterministic policy engine for evidence-bound cross-border research. Records distinguish claim type, legal status, provenance, source disposition, freshness and independent review. Policy evaluations are decision support only: execution_authorized remains false. The 20 August 2026 snapshot contains 152 records and 46 structural candidates, with 0 strictly citable current-law records; those counts are not verified current-law coverage. The software is Apache-2.0 and the dataset is CC-BY-4.0. Release assets and available archival identifiers are linked from the repository; an archive DOI is not claimed for every tag.

    Please use SPDX license expression format; examples include "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "GPL-2.0+", "LGPL-3.0+", "MIT", and "(BSD-2-Clause OR Ruby)". Do not include single quotes or double quotes.
    If there is more than one language, list them as comma-separated values (spaces optional) and sort them from most to least used. If there is a long list, please list at least the first three most common ones. If there is no language (e.g., this is a documentation-only or test-only project), use the single character "-". Please use a conventional capitalization for each language, e.g., "JavaScript".
    The Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software, and packages. It is used in a number of systems and databases when reporting vulnerabilities.

    Scope note for reviewers: this project produces two artifacts under two
    licenses. The software (src/cbsr_mcp/, tools/, scripts/, build*.py)
    is Apache-2.0 and is what these criteria are answered against. The dataset
    (*.yaml, dataset.json, analysis/, api/) is CC-BY-4.0; CC-BY-4.0 is not
    OSI-approved and is not claimed as a FLOSS software license. See LICENSING.md.

    The project uses cryptographic hashing (SHA-256) for artifact checksums and
    tamper-evident decision receipts. It performs no encryption, no key agreement,
    no key generation, and no password storage. Receipts detect mutation only;
    they are not signatures. Crypto criteria are answered on that basis.

  • Prerequisites


    Enough for a badge!

    The project MUST achieve a passing level badge. [achieve_passing]

  • Basic project website content


    Enough for a badge!

    The information on how to contribute MUST include the requirements for acceptable contributions (e.g., a reference to any required coding standard). (URL required) [contribution_requirements]

    CONTRIBUTING.md states the requirements for an acceptable contribution: a
    record must be schema-valid, must cite a primary source with a pinpoint that
    the contributor has verified personally, and must pass the single canonical
    gate python -m tools.verify with no committed-output drift across two
    generation passes. Draft records carrying <VERIFY markers are accepted but are
    merged as drafts, not as verified coverage. Dependency changes additionally
    require a passing Linux Python 3.10-3.13 matrix and a Windows clean-room job.
    The sourcing rule is in METHODOLOGY.md.
    https://github.com/yunjiefanresearch-hub/cross-border-stablecoin-register/blob/main/CONTRIBUTING.md


  • Project oversight


    Enough for a badge!

    The project SHOULD have a legal mechanism where all developers of non-trivial amounts of project software assert that they are legally authorized to make these contributions. The most common and easily-implemented approach for doing this is by using a Developer Certificate of Origin (DCO), where users add "signed-off-by" in their commits and the project links to the DCO website. However, this MAY be implemented as a Contributor License Agreement (CLA), or other legal mechanism. (URL required) [dco]
    The DCO is the recommended mechanism because it's easy to implement, tracked in the source code, and git directly supports a "signed-off" feature using "commit -s". To be most effective it is best if the project documentation explains what "signed-off" means for that project. A CLA is a legal agreement that defines the terms under which intellectual works have been licensed to an organization or project. A contributor assignment agreement (CAA) is a legal agreement that transfers rights in an intellectual work to another party; projects are not required to have CAAs, since having CAA increases the risk that potential contributors will not contribute, especially if the receiver is a for-profit organization. The Apache Software Foundation CLAs (the individual contributor license and the corporate CLA) are examples of CLAs, for projects which determine that the risks of these kinds of CLAs to the project are less than their benefits.

    Evidence: https://github.com/yunjiefanresearch-hub/cross-border-stablecoin-register/blob/1131c092f2fb681db5bff8544284faf475abb2f1/CONTRIBUTING.md


    Enough for a badge!

    The project MUST clearly define and document its project governance model (the way it makes decisions, including key roles). (URL required) [governance]
    There needs to be some well-established documented way to make decisions and resolve disputes. In small projects, this may be as simple as "the project owner and lead makes all final decisions". There are various governance models, including benevolent dictator and formal meritocracy; for more details, see Governance models. Both centralized (e.g., single-maintainer) and decentralized (e.g., group maintainers) approaches have been successfully used in projects. The governance information does not need to document the possibility of creating a project fork, since that is always possible for FLOSS projects.

    GOVERNANCE.md documents the project's decision-making model, the accountable maintainer, contributor responsibilities, review and verification stages, merge and release decisions, amendment process, licensing boundary, and conflict-of-interest safeguards. It explicitly distinguishes committed workflow declarations from separately configured repository enforcement.

    Evidence: https://github.com/yunjiefanresearch-hub/cross-border-stablecoin-register/blob/1131c092f2fb681db5bff8544284faf475abb2f1/GOVERNANCE.md


    Enough for a badge!

    The project MUST adopt a code of conduct and post it in a standard location. (URL required) [code_of_conduct]
    Projects may be able to improve the civility of their community and to set expectations about acceptable conduct by adopting a code of conduct. This can help avoid problems before they occur and make the project a more welcoming place to encourage contributions. This should focus only on behavior within the community/workplace of the project. Example codes of conduct are the Linux kernel code of conduct, the Contributor Covenant Code of Conduct, the Debian Code of Conduct, the Ubuntu Code of Conduct, the Fedora Code of Conduct, the GNOME Code Of Conduct, the KDE Community Code of Conduct, the Python Community Code of Conduct, The Ruby Community Conduct Guideline, and The Rust Code of Conduct.

    The root CODE_OF_CONDUCT.md requires professional and evidence-based participation, prohibits harassment, discrimination, threats, doxxing and privacy violations, defines maintainer enforcement powers, and provides a confidential reporting route with conflict disclosure and protection against retaliation.

    Evidence: https://github.com/yunjiefanresearch-hub/cross-border-stablecoin-register/blob/1131c092f2fb681db5bff8544284faf475abb2f1/CODE_OF_CONDUCT.md


    Enough for a badge!

    The project MUST clearly define and publicly document the key roles in the project and their responsibilities, including any tasks those roles must perform. It MUST be clear who has which role(s), though this might not be documented in the same way. (URL required) [roles_responsibilities]
    The documentation for governance and roles and responsibilities may be in one place.

    GOVERNANCE.md identifies Yunjie Fan as the accountable maintainer and defines responsibilities for data integrity, verification standards, releases and charter enforcement. It also defines contributor and review responsibilities. CODEOWNERS maps repository areas to the responsible maintainer account; this is a responsibility map, not evidence of a second maintainer or completed independent review.

    Evidence:


    Enough for a badge!

    The project MUST be able to continue with minimal interruption if any one person dies, is incapacitated, or is otherwise unable or unwilling to continue support of the project. In particular, the project MUST be able to create and close issues, accept proposed changes, and release versions of software, within a week of confirmation of the loss of support from any one individual. This MAY be done by ensuring someone else has any necessary keys, passwords, and legal rights to continue the project. Individuals who run a FLOSS project MAY do this by providing keys in a lockbox and a will providing any needed legal rights (e.g., for DNS names). (URL required) [access_continuity]

    Evidence: https://github.com/yunjiefanresearch-hub/cross-border-stablecoin-register/blob/1131c092f2fb681db5bff8544284faf475abb2f1/GOVERNANCE.md#7-amendment-and-continuity


    Enough for a badge!

    The project SHOULD have a "bus factor" of 2 or more. (URL required) [bus_factor]
    A "bus factor" (aka "truck factor") is the minimum number of project members that have to suddenly disappear from a project ("hit by a bus") before the project stalls due to lack of knowledgeable or competent personnel. The truck-factor tool can estimate this for projects on GitHub. For more information, see Assessing the Bus Factor of Git Repositories by Cosentino et al.

    Evidence: https://github.com/yunjiefanresearch-hub/cross-border-stablecoin-register/blob/1131c092f2fb681db5bff8544284faf475abb2f1/docs/security/OPENSSF_GOLD.md


  • Documentation


    Enough for a badge!

    The project MUST have a documented roadmap that describes what the project intends to do and not do for at least the next year. (URL required) [documentation_roadmap]
    The project might not achieve the roadmap, and that's fine; the purpose of the roadmap is to help potential users and contributors understand the intended direction of the project. It need not be detailed.

    Section 25 of the architecture white paper documents a three-year roadmap: year one addresses official-source, freshness, review and engineering-governance gaps; year two considers reviewed domain packs and authenticated/signed receipts in controlled pilots; year three evaluates adoption, interoperability, redress and longitudinal outcomes. These phases are conditional on evidence and governance approval. The Charter documents continuing non-goals and scope boundaries, including no unsupported claims or predictions and depth before breadth.

    Evidence:


    Enough for a badge!

    The project MUST include documentation of the architecture (aka high-level design) of the software produced by the project. If the project does not produce software, select "not applicable" (N/A). (URL required) [documentation_architecture]
    A software architecture explains a program's fundamental structures, i.e., the program's major components, the relationships among them, and the key properties of these components and relationships.

    Paste-ready justification:

    ADR 0001 documents the high-level architecture and responsibilities of the typed core, offline data loader, evidence and event layers, stablecoin domain pack, canonical serialization, public API projections, tool registry and server composition root. It describes interface versioning, compatibility boundaries and the separation between generic policy models and domain-specific rules.

    Evidence: https://github.com/yunjiefanresearch-hub/cross-border-stablecoin-register/blob/1131c092f2fb681db5bff8544284faf475abb2f1/docs/adr/0001-modular-mcp-policy-boundaries.md


    Enough for a badge!

    The project MUST document what the user can and cannot expect in terms of security from the software produced by the project (its "security requirements"). (URL required) [documentation_security]
    These are the security requirements that the software is intended to meet.

    SECURITY.md and the threat model state the software's security requirements and limitations: offline decision support, fail-closed evidence handling, no transaction execution or key custody, and execution_authorized always false. They distinguish mutation-detecting hashes from signatures and document supply-chain checks, release hard stops and residual human-review limitations.

    Evidence:


    Enough for a badge!

    The project MUST provide a "quick start" guide for new users to help them quickly do something with the software. (URL required) [documentation_quick_start]
    The idea is to show users how to get started and make the software do anything at all. This is critically important for potential users to get started.

    The README provides isolated-environment setup and the canonical verification command. CONNECT_MCP.md provides prerequisites, source installation, copy-paste client configurations and initial example queries, and also describes a zero-setup static JSON API. Platform and hash-lock limitations are explicitly documented.

    Evidence:


    Enough for a badge!

    The project MUST make an effort to keep the documentation consistent with the current version of the project results (including software produced by the project). Any known documentation defects making it inconsistent MUST be fixed. If the documentation is generally current, but erroneously includes some older information that is no longer true, just treat that as a defect, then track and fix as usual. [documentation_current]
    The documentation MAY include information about differences or changes between versions of the software and/or link to older versions of the documentation. The intent of this criterion is that an effort is made to keep the documentation consistent, not that the documentation must be perfect.

    The project enforces many generated documentation and identifier consistency checks, but known inconsistencies remain. ROADMAP.md still labels v0.10.0 as current, and the compatibility matrix still describes hosted Linux and Windows evidence as unverified despite newer published successful runs. These documents must be corrected or clearly labelled as historical before this criterion is marked Met.

    Evidence:


    Enough for a badge!

    The project repository front page and/or website MUST identify and hyperlink to any achievements, including this best practices badge, within 48 hours of public recognition that the achievement has been attained. (URL required) [documentation_achievements]
    An achievement is any set of external criteria that the project has specifically worked to meet, including some badges. This information does not need to be on the project website front page. A project using GitHub can put achievements on the repository front page by adding them to the README file.

    Evidence: https://github.com/yunjiefanresearch-hub/cross-border-stablecoin-register/blob/1131c092f2fb681db5bff8544284faf475abb2f1/README.md


  • Accessibility and internationalization


    Enough for a badge!

    The project (both project sites and project results) SHOULD follow accessibility best practices so that persons with disabilities can still participate in the project and use the project results where it is reasonable to do so. [accessibility_best_practices]
    For web applications, see the Web Content Accessibility Guidelines (WCAG 2.0) and its supporting document Understanding WCAG 2.0; see also W3C accessibility information. For GUI applications, consider using the environment-specific accessibility guidelines (such as Gnome, KDE, XFCE, Android, iOS, Mac, and Windows). Some TUI applications (e.g. `ncurses` programs) can do certain things to make themselves more accessible (such as `alpine`'s `force-arrow-cursor` setting). Most command-line applications are fairly accessible as-is. This criterion is often N/A, e.g., for program libraries. Here are some examples of actions to take or issues to consider:
    • Provide text alternatives for any non-text content so that it can be changed into other forms people need, such as large print, braille, speech, symbols or simpler language ( WCAG 2.0 guideline 1.1)
    • Color is not used as the only visual means of conveying information, indicating an action, prompting a response, or distinguishing a visual element. ( WCAG 2.0 guideline 1.4.1)
    • The visual presentation of text and images of text has a contrast ratio of at least 4.5:1, except for large text, incidental text, and logotypes ( WCAG 2.0 guideline 1.4.3)
    • Make all functionality available from a keyboard (WCAG guideline 2.1)
    • A GUI or web-based project SHOULD test with at least one screen-reader on the target platform(s) (e.g. NVDA, Jaws, or WindowEyes on Windows; VoiceOver on Mac & iOS; Orca on Linux/BSD; TalkBack on Android). TUI programs MAY work to reduce overdraw to prevent redundant reading by screen-readers.

    Evidence: https://github.com/yunjiefanresearch-hub/cross-border-stablecoin-register/blob/1131c092f2fb681db5bff8544284faf475abb2f1/index.html


    Enough for a badge!

    The software produced by the project SHOULD be internationalized to enable easy localization for the target audience's culture, region, or language. If internationalization (i18n) does not apply (e.g., the software doesn't generate text intended for end-users and doesn't sort human-readable text), select "not applicable" (N/A). [internationalization]
    Localization "refers to the adaptation of a product, application or document content to meet the language, cultural and other requirements of a specific target market (a locale)." Internationalization is the "design and development of a product, application or document content that enables easy localization for target audiences that vary in culture, region, or language." (See W3C's "Localization vs. Internationalization".) Software meets this criterion simply by being internationalized. No localization for another specific language is required, since once software has been internationalized it's possible for others to work on localization.

    The software consistently supports UTF-8 input/output and non-UTF-8 console environments, but its user-facing Register interface and many messages remain hard-coded in English without a localization resource layer. Unicode portability and a separate bilingual landing page do not by themselves establish internationalization of the produced software.

    Evidence:


  • Other


    Enough for a badge!

    If the project sites (website, repository, and download URLs) store passwords for authentication of external users, the passwords MUST be stored as iterated hashes with a per-user salt by using a key stretching (iterated) algorithm (e.g., Argon2id, Bcrypt, Scrypt, or PBKDF2). If the project sites do not store passwords for this purpose, select "not applicable" (N/A). [sites_password_security]
    Note that the use of GitHub meets this criterion. This criterion only applies to passwords used for authentication of external users into the project sites (aka inbound authentication). If the project sites must log in to other sites (aka outbound authentication), they may need to store authorization tokens for that purpose differently (since storing a hash would be useless). This applies criterion crypto_password_storage to the project sites, similar to sites_https.

    CBSR's project-operated website and public data/download interfaces are static and do not implement external-user accounts or store user passwords. Repository and issue-tracker authentication is provided by GitHub, which the official criterion's detailed guidance identifies as meeting this requirement. CBSR does not handle or store GitHub account credentials. This answer covers the project sites and does not assert that CBSR implements its own password-storage system.

    Evidence:


 Change Control 1/1 ●

 Reporting 3/3 ●

  • Bug-reporting process


    Enough for a badge!

    The project MUST use an issue tracker for tracking individual issues. [report_tracker]

    The project uses the GitHub issue tracker for individual issues, with issue
    templates configured in .github/ISSUE_TEMPLATE/.
    https://github.com/yunjiefanresearch-hub/cross-border-stablecoin-register/issues


  • Vulnerability report process


    Enough for a badge!

    The project MUST give credit to the reporter(s) of all vulnerability reports resolved in the last 12 months, except for the reporter(s) who request anonymity. If there have been no vulnerabilities resolved in the last 12 months, select "not applicable" (N/A). (URL required) [vulnerability_report_credit]

    The available public evidence does not establish the complete set of vulnerability reports resolved during the previous 12 months or whether every reporter received the requested credit or anonymity. The maintainer must check the private reporting and remediation records before selecting Met or N/A. An empty public advisory list or a clean dependency audit does not establish that no reports were resolved.

    Evidence:


    Enough for a badge!

    The project MUST have a documented process for responding to vulnerability reports. (URL required) [vulnerability_response_process]
    This is strongly related to vulnerability_report_process, which requires that there be a documented way to report vulnerabilities. It also related to vulnerability_report_response, which requires response to vulnerability reports within a certain time frame.

    SECURITY.md documents confidential reporting, required report information, a protected-channel fallback, acknowledgement within three business days, initial triage within seven business days, coordinated disclosure with a default 90-day target, and completion checks for regression tests, dependency/security gates, checksums and advisories. These are documented response targets, not a claim that every historical report met them.

    Evidence: https://github.com/yunjiefanresearch-hub/cross-border-stablecoin-register/blob/1131c092f2fb681db5bff8544284faf475abb2f1/SECURITY.md#response-expectations-and-coordinated-disclosure


 Quality 19/19 ●

 Security 13/13 ●

 Analysis 2/2 ●

  • Static code analysis


    Enough for a badge!

    The project MUST use at least one static analysis tool with rules or approaches to look for common vulnerabilities in the analyzed language or environment, if there is at least one FLOSS tool that can implement this criterion in the selected language. [static_analysis_common_vulnerabilities]
    Static analysis tools that are specifically designed to look for common vulnerabilities are more likely to find them. That said, using any static tools will typically help find some problems, so we are suggesting but not requiring this for the 'passing' level badge.

    CodeQL's default Python query suite includes rules for common vulnerability classes in the language and environment, including injection, path traversal and unsafe deserialization.


  • Dynamic code analysis


    Enough for a badge!

    If the software produced by the project includes software written using a memory-unsafe language (e.g., C or C++), then at least one dynamic tool (e.g., a fuzzer or web application scanner) MUST be routinely used in combination with a mechanism to detect memory safety problems such as buffer overwrites. If the project does not produce software written in a memory-unsafe language, choose "not applicable" (N/A). [dynamic_analysis_unsafe]
    Examples of mechanisms to detect memory safety problems include Address Sanitizer (ASAN) (available in GCC and LLVM), Memory Sanitizer, and valgrind. Other potentially-used tools include thread sanitizer and undefined behavior sanitizer. Widespread assertions would also work.

    N/A: the project produces no software written in a memory-unsafe language. The implementation is pure Python.



You can use tools and AI systems to propose changes via a simple URL, such as https://www.bestpractices.dev/en/projects/14172/choose/edit?osps_ac_01_01_status=Met&osps_ac_01_01_justification=GitHub+enforced. See our automation proposals system for how to do that. This data is available under the Community Data License Agreement – Permissive, Version 2.0 (CDLA-Permissive-2.0). This means that a Data Recipient may share the Data, with or without modifications, so long as the Data Recipient makes available the text of this agreement with the shared Data. Please credit yunjiefanresearch-hub and the OpenSSF Best Practices badge contributors.

Project badge entry owned by: yunjiefanresearch-hub.
Entry created on 2026-08-20 07:54:43 UTC, last updated on 2026-09-28 05:52:56 UTC. Last achieved passing badge on 2026-08-20 10:57:39 UTC.