Blanc

Projects that follow the best practices below can voluntarily self-certify and show that they've achieved an Open Source Security Foundation (OpenSSF) best practices badge.

There is no set of practices that can guarantee that software will never have defects or vulnerabilities; even formal methods can fail if the specifications or assumptions are wrong. Nor is there any set of practices that can guarantee that a project will sustain a healthy and well-functioning development community. However, following best practices can help improve the results of projects. For example, some practices enable multi-person review before release, which can both help find otherwise hard-to-find technical vulnerabilities and help build trust and a desire for repeated interaction among developers from different companies. To earn a badge, all MUST and MUST NOT criteria must be met, all SHOULD criteria must be met OR be unmet with justification, and all SUGGESTED criteria must be met OR unmet (we want them considered at least). If you want to enter justification text as a generic comment, instead of being a rationale that the situation is acceptable, start the text block with '//' followed by a space. Feedback is welcome via the GitHub site as issues or pull requests There is also a mailing list for general discussion.

We gladly provide the information in several locales, however, if there is any conflict or inconsistency between the translations, the English version is the authoritative version.
If this is your project, please show your baseline badge status on your project page! The baseline badge status looks like this: Baseline badge level for project 14451 is baseline-1 Here is how to embed the baseline badge:
You can show your baseline badge status by embedding this in your markdown file:
[![OpenSSF Baseline](https://www.bestpractices.dev/projects/14451/baseline)](https://www.bestpractices.dev/projects/14451)
or by embedding this in your HTML:
<a href="https://www.bestpractices.dev/projects/14451"><img src="https://www.bestpractices.dev/projects/14451/baseline"></a>


These are the Baseline Level 1 criteria. These are criteria version v2026.08.28.

Baseline Series: Baseline Level 1 Baseline Level 2 Baseline Level 3

        

 Basics

  • General

    Note that other projects may use the same name.

    Blanc is an open-source Electron desktop browser for macOS, Windows, and Linux, with compact Island chrome and built-in ad/tracker blocking.

    Please use SPDX license expression format; examples include "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "GPL-2.0+", "LGPL-3.0+", "MIT", and "(BSD-2-Clause OR Ruby)". Do not include single quotes or double quotes.
    If there is more than one language, list them as comma-separated values (spaces optional) and sort them from most to least used. If there is a long list, please list at least the first three most common ones. If there is no language (e.g., this is a documentation-only or test-only project), use the single character "-". Please use a conventional capitalization for each language, e.g., "JavaScript".
    The Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software, and packages. It is used in a number of systems and databases when reporting vulnerabilities.

    Application in progress; no independent security certification or completed external audit is claimed. Bananify Creative-owned software is MIT-licensed. Reserved identity artwork and third-party licensing terms are documented at https://github.com/bnfy/blanc/blob/main/ASSET-LICENSE.md and https://github.com/bnfy/blanc/blob/main/THIRD-PARTY-NOTICES.md. Release evidence: https://github.com/bnfy/blanc/blob/main/docs/release-incidents/2026-09-02-v1.15.0.md

 Controls 24/24 ●

  • Controls


    Enough for a badge!

    When a user attempts to read or modify a sensitive resource in the project's authoritative repository, the system MUST require the user to complete a multi-factor authentication process. [OSPS-AC-01.01]
    Enforce multi-factor authentication for the project's version control system, requiring collaborators to provide a second form of authentication when accessing sensitive data or modifying repository settings. Passkeys are acceptable for this control.

    Verified 2026-09-04: GitHub account security shows two-factor authentication Enabled and required for bnfy. The repository collaborator API lists bnfy as its sole human collaborator/administrator. Sensitive repository changes therefore require an MFA-protected maintainer account. Recheck before adding collaborators.


    Enough for a badge!

    When a new collaborator is added, the version control system MUST require manual permission assignment, or restrict the collaborator permissions to the lowest available privileges by default. [OSPS-AC-02.01]
    Most public version control systems are configured in this manner. Ensure the project's version control system always assigns the lowest available permissions to collaborators by default when added, granting additional permissions only when necessary.

    The authoritative repository is owned by the GitHub personal account bnfy, its sole human collaborator as verified on 2026-09-04. GitHub requires the owner to explicitly invite a selected person before collaborator access is granted; there is no automatic collaborator enrollment. Personal repositories offer owner and collaborator roles, so this relies on manual assignment, not a claim of granular read-only collaborator roles. Platform documentation: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/repository-access-and-collaboration/inviting-collaborators-to-a-personal-repository


    Enough for a badge!

    When a direct commit is attempted on the project's primary branch, an enforcement mechanism MUST prevent the change from being applied. [OSPS-AC-03.01]
    If the VCS is centralized, set branch protection on the primary branch in the project's VCS. Alternatively, use a decentralized approach, like the Linux kernel's, where changes are first proposed in another repository, and merging changes into the primary repository requires a specific separate act.

    Main branch protection enabled and independently read back on 2026-09-04: pull requests required, enforce_admins=true, four required GitHub Actions checks with strict up-to-date checking. Direct main pushes are blocked, including administrators. The approval count is zero for the sole-maintainer project; independent human review is not claimed.


    Enough for a badge!

    When an attempt is made to delete the project's primary branch, the version control system MUST treat this as a sensitive activity and require explicit confirmation of intent. [OSPS-AC-03.02]
    Set branch protection on the primary branch in the project's version control system to prevent deletion.

    Main branch protection read back from the GitHub API on 2026-09-04 has allow_deletions.enabled=false and enforce_admins.enabled=true. Deletion is blocked while the rule is enabled. The criterion implementation guidance explicitly accepts branch protection that prevents deletion.


    Enough for a badge!

    When a CI/CD pipeline operates on untrusted metadata, those parameters MUST be sanitized and validated prior to use in the pipeline. [OSPS-BR-01.01]
    CI/CD pipelines should sanitize (quote, escape or exit on expected values) all metadata inputs which correspond to untrusted sources. This includes data such as branch names, commit messages, tags, pull request titles, and author information.

    No untrusted metadata is consumed by custom pipeline commands in the five workflows reviewed at main 8d4599bca2b8380da1e1c74c2df28cbcbdd83aea: https://github.com/bnfy/blanc/tree/8d4599bca2b8380da1e1c74c2df28cbcbdd83aea/.github/workflows . PR titles, bodies, messages and external branch names are not interpolated into run scripts. Checkout uses the platform-selected PR merge ref. Manual release inputs are supplied by trusted collaborators; the Baseline addresses these separately in OSPS-BR-01.04. Release-tag environment transport hardening is pending in PR #288 and is not claimed as merged. Reassess this N/A if workflows begin consuming untrusted metadata.


    Enough for a badge!

    When a CI/CD pipeline operates on untrusted code snapshots, it MUST prevent access to privileged CI/CD credentials and assets. [OSPS-BR-01.03]
    CI/CD pipelines should isolate untrusted code snapshots from privileged credentials and assets. In particular, projects should be careful to ensure that workflows which build or execute code prior to review by a collaborator do not have access to CI/CD credentials.

    Reviewed all five authoritative workflows at https://github.com/bnfy/blanc/tree/8d4599bca2b8380da1e1c74c2df28cbcbdd83aea/.github/workflows . Outside contributions use pull_request on GitHub-hosted runners; there is no pull_request_target, workflow_run artifact execution, or self-hosted runner. GitHub withholds repository secrets and restricts fork PR tokens to read-only: https://docs.github.com/en/actions/reference/security/securely-using-pull_request_target . Build/test PR jobs explicitly use contents:read; CodeQL analyzes without executing a project build. Signing secrets and publication grants are confined to the manually dispatched native workflow, requiring trusted collaborator action on reviewed code. Repository API verified default_workflow_permissions=read and can_approve_pull_request_reviews=false on 2026-09-04. This does not claim build/sign job separation or an independent human review.


    Enough for a badge!

    When the project lists a URI as an official project channel, that URI MUST be exclusively delivered using encrypted channels. [OSPS-BR-03.01]
    Configure the project's websites and version control systems to use encrypted channels such as SSH or HTTPS for data transmission. Ensure all tools and domains referenced in project documentation can only be accessed via encrypted channels.

    Project URLs use HTTPS exclusively.


    Enough for a badge!

    When the project lists a URI as an official distribution channel, that channel MUST be protected from adversary-in-the-middle attacks using cryptographically authenticated channels. [OSPS-BR-03.02]
    Artifacts distributed by the project should be distributed through channels which ensure integrity and authenticity. Use of HTTPS for downloads, signed releases, or distribution through trusted package managers are all acceptable methods to protect against adversary-in-the-middle attacks.

    Distribution channels use HTTPS exclusively.


    Enough for a badge!

    The project MUST prevent the unintentional storage of unencrypted sensitive data, such as secrets and credentials, in the version control system. [OSPS-BR-07.01]
    Configure .gitignore or equivalent to exclude files that may contain sensitive information. Use pre-commit hooks and automated scanning tools to detect and prevent the inclusion of sensitive data in commits.

    GitHub repository security settings verified on 2026-09-04 show secret_scanning and secret_scanning_push_protection enabled for bnfy/blanc. These prevent pushes of recognized secret types; this does not claim detection of every secret.


    Enough for a badge!

    When the project has made a release, the project documentation MUST include user guides for all basic functionality. [OSPS-DO-01.01]
    Create user guides or documentation for all basic functionality of the project, explaining how to install, configure, and use the project's features. If there are any known dangerous or destructive actions available, include highly-visible warnings.

    Published in merged PR #285, commit daf4663cc778cb278fc1179ef869a3a906b4ac94: https://github.com/bnfy/blanc/blob/main/docs/user-guide.md . Covers installation, navigation, tabs/groups/workspaces, favorites/imports/history/downloads, private browsing, blocking, permissions, profiles/sync, start-page options, updates and help. The companion docs/user-guide-evidence.md maps the guide to public v1.15.0 source and release evidence.


    Enough for a badge!

    When the project has made a release, the project documentation MUST include a guide for reporting defects. [OSPS-DO-02.01]
    It is recommended that projects use their VCS default issue tracker. If an external source is used, ensure that the project documentation and contributing guide clearly and visibly explain how to use the reporting system. It is recommended that project documentation also sets expectations for how defects will be triaged and resolved.

    Public defect reports use https://github.com/bnfy/blanc/issues and the bug report form at https://github.com/bnfy/blanc/blob/main/.github/ISSUE_TEMPLATE/bug_report.yml . Security issues are reported privately using SECURITY.md.


    Enough for a badge!

    The project MUST have one or more mechanisms for public discussions about proposed changes and usage obstacles. [OSPS-GV-02.01]
    Establish one or more mechanisms for public discussions within the project, such as mailing lists, instant messaging, or issue trackers, to facilitate open communication and feedback.

    GitHub supports public discussions on proposed changes (via pull requests) and usage obstacles (via issues).


    Enough for a badge!

    The project documentation MUST include an explanation of the contribution process, or clearly state that public contributions are not accepted [OSPS-GV-03.01]
    Create a CONTRIBUTING.md or CONTRIBUTING/ directory to outline the contribution process including the steps for submitting changes, and engaging with the project maintainers.

    Published contribution process: https://github.com/bnfy/blanc/blob/main/CONTRIBUTING.md . Covers reports, development setup, validation, pull requests/review, licensing and conduct. Merged in PR #285 at daf4663cc778cb278fc1179ef869a3a906b4ac94 on 2026-09-04.


    Enough for a badge!

    The license for the source code MUST meet the OSI Open Source Definition or the FSF Free Software Definition. [OSPS-LE-02.01]
    Add a LICENSE file to the project's repo with a license that is an approved license by the Open Source Initiative (OSI), or a free license as approved by the Free Software Foundation (FSF). Examples of such licenses include the MIT, BSD 2-clause, BSD 3-clause revised, Apache 2.0, Lesser GNU General Public License (LGPL), and the GNU General Public License (GPL). Releasing to the public domain meets this control if there are no other encumbrances such as patents.

    Bananify Creative-owned software is MIT-licensed: https://github.com/bnfy/blanc/blob/main/LICENSE . Upstream components retain their own licenses; identity artwork remains reserved. See THIRD-PARTY-NOTICES.md and ASSET-LICENSE.md in the same repository.


    Enough for a badge!

    The license for the released software assets MUST meet the OSI Open Source Definition or the FSF Free Software Definition. [OSPS-LE-02.02]
    If a different license is included with released software assets, ensure it is an approved license by the Open Source Initiative (OSI), or a free license as approved by the Free Software Foundation (FSF). Examples of such licenses include the MIT, BSD 2-clause, BSD 3-clause revised, Apache 2.0, Lesser GNU General Public License (LGPL), and the GNU General Public License (GPL). Note that the license for the released software assets may be different than the source code.

    Bananify Creative-owned software is MIT-licensed: https://github.com/bnfy/blanc/blob/main/LICENSE . Third-party components retain their own terms and identity artwork is reserved; see https://github.com/bnfy/blanc/blob/main/THIRD-PARTY-NOTICES.md and https://github.com/bnfy/blanc/blob/main/ASSET-LICENSE.md . This is not a blanket MIT claim for every repository asset. [floss_license]


    Enough for a badge!

    The license for the source code MUST be maintained in the corresponding repository's LICENSE file, COPYING file, LICENSES/ directory, or LICENSE/ directory. [OSPS-LE-03.01]
    Include the project's source code license in the project's LICENSE file, COPYING file, LICENSES/ directory, or LICENSE/ directory to provide visibility and clarity on the licensing terms. The filename MAY have an extension. If the project has multiple repositories, ensure that each repository includes the license file.

    License file found in repository.


    Enough for a badge!

    The license for the released software assets MUST be included in the released source code, or in a LICENSE file, COPYING file, or LICENSE/ directory alongside the corresponding release assets. [OSPS-LE-03.02]
    Include the project's released software assets license in the released source code, or in a LICENSE file, COPYING file, or LICENSE/ directory alongside the corresponding release assets to provide visibility and clarity on the licensing terms. The filename MAY have an extension. If the project has multiple repositories, ensure that each repository includes the license file.

    Main software license: https://github.com/bnfy/blanc/blob/main/LICENSE . Reserved identity artwork: https://github.com/bnfy/blanc/blob/main/ASSET-LICENSE.md . Upstream terms: https://github.com/bnfy/blanc/blob/main/THIRD-PARTY-NOTICES.md [license_location]


    Enough for a badge!

    The project's source code repository MUST be publicly readable at a static URL. [OSPS-QA-01.01]
    Use a common VCS such as GitHub, GitLab, or Bitbucket. Ensure the repository is publicly readable. Avoid duplication or mirroring of repositories unless highly visible documentation clarifies the primary source. Avoid frequent changes to the repository that would impact the repository URL. Ensure the repository is public.

    Repository is publicly available on GitHub.


    Enough for a badge!

    The version control system MUST contain a publicly readable record of all changes made, who made the changes, and when the changes were made. [OSPS-QA-01.02]
    Use a common VCS such as GitHub, GitLab, or Bitbucket to maintain a publicly readable commit history. Avoid squashing or rewriting commits in a way that would obscure the author of any commits.

    Repository git metadata is publicly available on GitHub.


    Enough for a badge!

    When the package management system supports it, the source code repository MUST contain a dependency list that accounts for the direct language dependencies. [OSPS-QA-02.01]
    This may take the form of a package manager or language dependency file that enumerates all direct dependencies such as package.json, Gemfile, or go.mod.

    Direct npm dependencies are listed in https://github.com/bnfy/blanc/blob/v1.15.0/package.json with package-lock.json recording the resolved dependency tree.


    Enough for a badge!

    Projects with multiple repositories MUST document a list of codebases that are part of the project. [OSPS-QA-04.01]
    Document any additional subproject code repositories produced by the project and compiled into a release. This documentation should include the status and intent of the respective codebase.

    Project owner Anthony Loria confirmed on 2026-09-04 that https://github.com/bnfy/blanc is the only first-party Blanc code repository, including private services/apps. Desktop source, website and sync/ping/newsletter Worker sources are in this repository; no Git submodules are present. The multi-repository requirement is therefore not applicable. Reassess if any additional first-party repository is introduced.


    Enough for a badge!

    The version control system MUST NOT contain generated executable artifacts. [OSPS-QA-05.01]
    Remove generated executable artifacts in the project's version control system. It is recommended that any scenario where a generated executable artifact appears critical to a process such as testing, it should be instead be generated at build time or stored separately and fetched during a specific well-documented pipeline step.

    PR #289 merged at 3046d173cd30a5713bd0ef1b7707dc0a14d5223b removes the generated blocker seed binary from Git. npm ci/install regenerates it from pinned sources and requires an exact match with the tracked manifest before writing. See https://github.com/bnfy/blanc/blob/main/docs/blocker-seed-build.md . The reviewed complete merged tree has no native executables, shared libraries, WASM, native addons, application archives, bytecode or minified JavaScript artifacts. Reviewable generated source and media assets remain. CI, Windows/Linux packaged-payload validation and local signed macOS first-run checks passed. The owner-machine confirmation waiver is recorded in docs/release-incidents/2026-09-04-badge-seed-waiver.md; no new public release is claimed.


    Enough for a badge!

    The version control system MUST NOT contain unreviewable binary artifacts. [OSPS-QA-05.02]
    Do not add any unreviewable binary artifacts to the project's version control system. This includes executable application binaries, library files, and similar artifacts. It does not include assets such as graphical images, sound or music files, and similar content typically stored in a binary format.

    Reviewed tracked artifacts on 2026-09-04. No native executables, shared libraries, WASM, Electron archives or dependency archives were found. Media/fonts are reviewable assets with provenance in THIRD-PARTY-NOTICES.md. The Apple provisioning profile is CMS/plist-decodable and checked by scripts/preflight-mac-signing.mjs and scripts/after-sign-verify.js. The blocker seed is reproducible from pinned tracked filter/resource inputs using https://github.com/bnfy/blanc/blob/main/adblock/seed.mjs ; npm run adblock:check verified exact regeneration (108342 rules; 5404689-byte seed, hash prefix 194ddc2d204c13b9). This establishes reviewability, not the separate generated-executable criterion.


    Enough for a badge!

    The project documentation MUST contain security contacts. [OSPS-VM-02.01]
    Create a security.md (or similarly-named) file that contains security contacts for the project.

    Published SECURITY.md gives the private reporting address, information to include, response targets, and disclosure process: https://github.com/bnfy/blanc/blob/main/SECURITY.md [vulnerability_report_process]



You can use tools and AI systems to propose changes via a simple URL, such as https://www.bestpractices.dev/en/projects/14451/choose/edit?osps_ac_01_01_status=Met&osps_ac_01_01_justification=GitHub+enforced. See our automation proposals system for how to do that. This data is available under the Community Data License Agreement – Permissive, Version 2.0 (CDLA-Permissive-2.0). This means that a Data Recipient may share the Data, with or without modifications, so long as the Data Recipient makes available the text of this agreement with the shared Data. Please credit BANANIFY and the OpenSSF Best Practices badge contributors.

Project badge entry owned by: BANANIFY.
Entry created on 2026-09-04 21:08:30 UTC, last updated on 2026-09-04 22:51:31 UTC.