[{"id":1,"user_id":25,"name":"BadgeApp","description":"BadgeApp is the web application that allows developers to provide information about their project and (hopefully) get an Open Source Security Foundation (OpenSSF) Best Practices badge. This project was originally known as the Core Infrastructure Initiative (CII) best practices badge project.\r\n\r\nThe Open Source Security Foundation (OpenSSF) is managed by The Linux Foundation.  The OpenSSF Best Practices badge online application (aka the BadgeApp) enables developers to quickly determine whether they are following best practices and to receive a badge they can display on GitHub and other locations. The application and its criteria are an open source project to which developers can contribute.\r\n\r\nYou can see the program running, and use it to try to get a badge, by visiting: https://bestpractices.dev/\r\n\r\nThe BadgeApp is written in Ruby on Rails and Javascript.\r\n\r\nSee the development site on GitHub for more about how we secure this application.\r\n\r\nNote that the BadgeApp gets both \"metal\" series badges and \"baseline\" series badges; we want to earn the badges we manage!","homepage_url":"https://github.com/ossf/best-practices-badge","repo_url":"https://github.com/ossf/best-practices-badge","license":"MIT","homepage_url_status":"?","homepage_url_justification":"","sites_https_status":"Met","sites_https_justification":"The project website and repo use GitHub, which supports HTTPS using TLS.  There's no separate download URL (use git to download from the repo).","description_good_status":"Met","description_good_justification":"https://github.com/ossf/best-practices-badge","interact_status":"Met","interact_justification":"https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md","contribution_status":"Met","contribution_justification":"https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md","contribution_requirements_status":"Met","contribution_requirements_justification":"https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md","license_location_status":"Met","license_location_justification":"It's in the LICENSE file in the top level directory.  See: https://github.com/ossf/best-practices-badge/blob/main/blob/main/LICENSE","floss_license_status":"Met","floss_license_justification":"The MIT license is widely acknowledged as being OSS.  The license is at https://github.com/ossf/best-practices-badge/blob/main/LICENSE The MIT license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The MIT license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"Met","documentation_basics_justification":"The directory \"doc\" contains most documentation. Installation information is at https://github.com/ossf/best-practices-badge/blob/main/docs/INSTALL.md and other materials are at https://github.com/ossf/best-practices-badge/tree/main/docs/","documentation_interface_status":"Met","documentation_interface_justification":"Its interface is defined here: https://github.com/ossf/best-practices-badge/blob/main/docs/implementation.md#interface","repo_public_status":"Met","repo_public_justification":"It uses git, URL is https://github.com/ossf/best-practices-badge/","repo_track_status":"Met","repo_track_justification":"Uses git to track this. Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"Met","repo_interim_justification":"Interim versions are put on git, not just final versions.","repo_distributed_status":"Met","repo_distributed_justification":"Uses git. Repository on GitHub, which uses git. git is distributed.","version_unique_status":"Met","version_unique_justification":"The primary single user uses git commit records to identify releases.","version_semver_status":"Unmet","version_semver_justification":"BadgeApp undergoes continuous integration and is then deployed to a single site, \u003chttps://bestpractices.dev/\u003e.  We used Semantic Versioning for a while, but SemVer is a poor fit for this kind of situation, and we eventually gave up the practice.  Every version continues to have a unique version identifier: the git commit id.","version_tags_status":"Met","version_tags_justification":"Full releases are tagged using 'git tag'.","release_notes_status":"Met","release_notes_justification":"CHANGELOG file is in top directory, see: https://github.com/ossf/best-practices-badge/blob/main/CHANGELOG.md","release_notes_vulns_status":"Met","release_notes_vulns_justification":"We intend to do that, though we don't know of any for-certain publicly known vulnerabilities.\r\n\r\nOur release notes do document that commit fdb83380 on 2015-11-26 updated gem nokogiri from 1.6.6.2 to 1.6.6.4 due to CVE-2015-1819.  It's not clear if our application was actually vulnerable; it was easier to simply upgrade.  In any case, we upgraded immediately, and this is documented in our release notes.\r\n","report_url_status":"?","report_url_justification":"","report_tracker_status":"Met","report_tracker_justification":"Yes, GitHub issue tracker.","report_process_status":"Met","report_process_justification":"Yes, either GitHub issue tracker or mailing list.  See: https://github.com/ossf/best-practices-badge/blob/main/README.md","report_responses_status":"Met","report_responses_justification":"Yes.  Not many have been submitted so far, but we've responded.","enhancement_responses_status":"Met","enhancement_responses_justification":"The project has been responding to most enhancement requests.","report_archive_status":"Met","report_archive_justification":"Yes, via GitHub isue tracker: https://github.com/ossf/best-practices-badge/issues","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"https://github.com/ossf/best-practices-badge/issues","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md","vulnerability_report_response_status":"Met","vulnerability_report_response_justification":"No external reports so far, so this is vacuously true.","build_status":"N/A","build_justification":"The software is written using Ruby and Javascript, and their implementations run directly on the source code.","build_common_tools_status":"N/A","build_common_tools_justification":"Note that a Gemfile.lock file and Rake tasks are provided to enable others to quickly recreate a development environment.","build_floss_tools_status":"N/A","test_status":"Met","test_justification":"Yes, it includes a test suite based on minitest (the test framework that comes with Rails).","test_invocation_status":"Met","test_invocation_justification":"Yes. \"rake test\" invokes the automated test suite. The default \"rake\" command includes \"rake test\".  This is documented in [CONTRIBUTING.md](https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md).","test_most_status":"Met","test_most_justification":"Met.  Currently coverage of the ruby code is over 90%, and most of the code is in Ruby.","test_policy_status":"Met","test_policy_justification":"Yes.  The CONTRIBUTING file at \u003chttps://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md\u003e says,  \"When adding or changing functionality, please include new tests for them as part of your contribution\". Also, the project home page shows the test coverage, which encourages adding tests as new functionality is added.","tests_are_added_status":"Met","tests_are_added_justification":"Tests are added as new functionality is added.","tests_documented_added_status":"Met","tests_documented_added_justification":"Yes.  The CONTRIBUTING file at \u003chttps://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md\u003e says,  \"When adding or changing functionality, please include new tests for them as part of your contribution\".","warnings_status":"Met","warnings_justification":"The set of tools used for examining code quality are listed in [CONTRIBUTING.md](https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md).\r\n\r\nThe project uses rubocop and rails_best_practices to check for code quality errors in Ruby code; eslint is used to look for problems in Javascript.  The markdown documentation is scanned with markdownlink.","warnings_fixed_status":"Met","warnings_fixed_justification":"In general warnings are addressed.  In some cases warnings are disabled for specific cases.","warnings_strict_status":"Met","warnings_strict_justification":"The settings for the warning tools are generally fairly strict.","know_secure_design_status":"Met","know_secure_design_justification":"David A. Wheeler, lead developer, literally wrote the code on how to design secure software: http://www.dwheeler.com/secure-programs","know_common_errors_status":"Met","know_common_errors_justification":"For a discussion of security requirements, common types of security vulnerabilities, and how this application counters those common kinds of vulnerabilities, see: https://github.com/ossf/best-practices-badge/blob/main/docs/security.md","crypto_published_status":"Met","crypto_published_justification":"The software uses bcrypt to store salted hashed iterated passwords, and https+standard crypto protocols to communicate with users.","crypto_call_status":"Met","crypto_call_justification":"Uses 'bcrypt' gem for bcrypt, and https implementation built into its web server.","crypto_floss_status":"Met","crypto_floss_justification":"All required functionality is implemented using FLOSS, including cryptography.","crypto_keylength_status":"N/A","crypto_keylength_justification":"Note: This application uses bcrypt, which uses 128-bit salt and produces 184 bits as a salted encrypted iterated hash.  This is less than 224 bits, but that's not really what the 224 bits of hash are for. ","crypto_working_status":"Met","crypto_working_justification":"The only cryptographic algorithm directly used by the program is bcrypt, which is not broken.","crypto_pfs_status":"N/A","crypto_pfs_justification":"Nothing in the code inhibits or prevents the use of PFS; that is a property of the website's web server.","crypto_password_storage_status":"Met","crypto_password_storage_justification":"Bcrypt used for storing local passwords.","crypto_random_status":"Met","crypto_random_justification":"The nonce for the salt is created by the bcrypt gem; its engine.rb file shows that it uses OpenSSL to get cryptographically random data for the salt (on Java it would use SecureRandom, which is still fine, but that is not the default configuration). Other nonces are part of the https implementation, which are implemented by the web server (not this application).","delivery_mitm_status":"Met","delivery_mitm_justification":"Uses https.","delivery_unsigned_status":"Met","delivery_unsigned_justification":"Does not make this mistake.","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_fixed_60_days_justification":"No such vulnerabilities at this time.","vulnerabilities_critical_fixed_status":"Met","vulnerabilities_critical_fixed_justification":"No such vulnerabilities at this time.","static_analysis_status":"Met","static_analysis_justification":"As noted in \u003chttps://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md\u003e, Brakeman, Rubocop, and rails_best_practices are used to analyze the Ruby code.  Brakeman is specifically designed to analyze Ruby on Rails code.  The Javascript client-side code is analyzed with ESLint, using over 100 rules.\r\n\r\nThese analysis tools are used as part of the default 'rake' process used in local development, as well as the \"pronto\" process run on the continuous integration server running on CircleCI.","static_analysis_common_vulnerabilities_status":"Met","static_analysis_common_vulnerabilities_justification":"Brakeman specifically looks for common vulnerabilities in Ruby on Rails applications.","static_analysis_fixed_status":"Met","static_analysis_fixed_justification":"This is vacuously true, since we've had no reports of vulnerabilities that apply to a deployed system.","static_analysis_often_status":"Met","static_analysis_often_justification":"All commits to GitHub are run through CircleCI, which performs a number of static analysis checks (Brakeman, Rubocop, etc.).","dynamic_analysis_status":"Met","dynamic_analysis_justification":"Analyzed with OWASP ZAP by Emily Ratliff","dynamic_analysis_unsafe_status":"N/A","dynamic_analysis_unsafe_justification":"Application written using Ruby and Javascript, not C/C++","dynamic_analysis_enable_assertions_status":"Unmet","dynamic_analysis_enable_assertions_justification":"Instead of embedding run-time assertions, there are many external tests with assertions that are checked during automated testing.","dynamic_analysis_fixed_status":"Met","dynamic_analysis_fixed_justification":"A few minor issues were found by OWASP ZAP during development; these have already been fixed.","general_comments":"We hope to see many other projects get their badge. Please start!\r\n\r\nNote that this badge entry is released under at least the Creative Commons Attribution version 3.0 or later license (CC-BY-3.0+).","created_at":"2015-10-23T22:02:10.544Z","updated_at":"2026-07-18T04:02:54.845Z","crypto_weaknesses_status":"Met","crypto_weaknesses_justification":"The only cryptography used directly by this application is bcrypt  (used for storing passwords as salted iterated hashes).  At the time of this writing, no serious breaks are known in bcrypt.  The application also depends on the web server's https configuration, but that is out of scope for this code.","test_continuous_integration_status":"Met","test_continuous_integration_justification":"Code is frequently integrated back into GitHub; CircleCI and several other tools are then run on the result to determine if there's a problem.  If a problem is found, the tools provide feedback via GitHub.  For more information, see the [BadgeApp's status on CircleCI](https://circleci.com/gh/ossf/best-practices-badge).","cpe":"","discussion_status":"Met","discussion_justification":"GitHub issue tracker and pull requests support discussion","no_leaked_credentials_status":"Met","no_leaked_credentials_justification":"No valid private credentials are leaked.  There is a [.env](https://github.com/ossf/best-practices-badge/blob/main/.env) file, but it only includes stub data for testing, not the live credentials.","english_status":"Met","english_justification":"All documentation is in English, and the project accepts bug reports and comments in English.","hardening_status":"Met","hardening_justification":"We use various HTTP headers for hardening, including a rigorous Content Security Policy (CSP) setting.  For more information, see [security.md](https://github.com/ossf/best-practices-badge/blob/main/docs/security.md) which discusses the hardening mechanisms.","crypto_used_network_status":"Met","crypto_used_network_justification":"https://github.com/ossf/best-practices-badge","crypto_tls12_status":"Met","crypto_tls12_justification":"Github uses TLS 1.2, see \u003chttps://github.com/ossf/best-practices-badge\u003e.","crypto_certificate_verification_status":"Met","crypto_certificate_verification_justification":"The software does not directly implement TLS, instead, it depends on the webserver and Ruby libraries to implement TLS - including certificate checking.  That said, there *is* a case where TLS certificate verification is necessary.\r\n\r\nThe only case where TLS certificate verification matters is that this application uses OAuth for access delegation (in this case, we contact GitHub to determine if someone is the claimed GitHub user).  In this case it *does* need to verify the TLS certificate, because if anyone could pretend to be the access delagatee (e.g., GitHub) then they could claim anything.  The application does not do this directly, instead this is done by the gems (Ruby libraries) we call for this purpose, which perform this checking.\r\n\r\nOther than that, this application does not use TLS certificate verification.  That's because it implements a server-side application, not a client-side application, and uses name/password or GitHub authentication for user authentication (not TLS certificates).","crypto_verification_private_status":"Met","crypto_verification_private_justification":"The software does not directly implement TLS, instead, it depends on the webserver and Ruby libraries to implement TLS - including certificate checking.  That said, there *is* a case where TLS certificate verification is necessary, and this is supported (indirectly) by the systems it depends on.\r\n\r\nThe only case where TLS certificate verification matters is that this application uses OAuth for access delegation (in this case, we contact GitHub to determine if someone is the claimed GitHub user).  In this case it *does* need to verify the TLS certificate, because if anyone could pretend to be the access delagatee (e.g., GitHub) then they could claim anything.  The application does not do this directly, instead this is done by the gems (Ruby libraries) we call for this purpose, which perform this checking.\r\n\r\nOther than that, this application does not use TLS certificate verification.  That's because it implements a server-side application, not a client-side application, and uses name/password or GitHub authentication for user authentication (not TLS certificates).","hardened_site_status":"Met","hardened_site_justification":"We use GitHub, and [securityheaders.io verifies that our sites meet this criterion](https://securityheaders.io/?q=https%3A%2F%2Fgithub.com%2Fcoreinfrastructure%2Fbest-practices-badge\u0026followRedirects=on).","installation_common_status":"Met","installation_common_justification":"We include an install script, `install_badge_dev_env` which allows devs to quickly install the software for development.  This script uses calls to various package managers to install all necessary dependencies quickly and easily.  The uninstall process is documented in [docs/INSTALL.md](https://github.com/ossf/best-practices-badge/blob/main/docs/INSTALL.md).","build_reproducible_status":"N/A","build_reproducible_justification":"The code is written in Ruby and Javascript, which are not delivered as compiled executables.","badge_percentage_0":100,"achieved_passing_at":"2023-09-19T06:10:30.864Z","lost_passing_at":"2023-09-19T06:10:11.390Z","last_reminder_at":null,"disabled_reminders":false,"implementation_languages":"Ruby, JavaScript","lock_version":120,"badge_percentage_1":100,"dco_status":"Met","dco_justification":"We require a DCO for contributions, as documented in https://github.com/linuxfoundation/cii-best-practices-badge/blob/master/CONTRIBUTING.md which says:\r\n\r\n\u003e All contributions (including pull requests) must agree to the [Developer Certificate of Origin (DCO) version 1.1](docs/dco.txt).\r\nThis is exactly the same one created and used by the Linux kernel developers and posted on \u003chttp://developercertificate.org/\u003e. This is a developer's certification that he or she has the right to submit the patch for inclusion into the project.\r\n","governance_status":"Met","governance_justification":"The governance mode of the Badge app is outlined in on our GitHub repository within [docs/governance.md](https://github.com/ossf/best-practices-badge/blob/main/docs/governance.md)","code_of_conduct_status":"Met","code_of_conduct_justification":"See [CODE_OF_CONDUCT](https://github.com/ossf/best-practices-badge/blob/master/CODE_OF_CONDUCT.md).","roles_responsibilities_status":"Met","roles_responsibilities_justification":"The document [docs/governance.md](https://github.com/ossf/best-practices-badge/blob/main/docs/governance.md) describes the key roles, which are basically \"technical lead\" and \"others with commit rights\".  It also identifies who has those roles.","access_continuity_status":"Met","access_continuity_justification":"This project is run by the Linux Foundation, a 501(c)6.  Multiple people are authorized to do all these activities (create and close issues, accept proposed changes, and release versions of software), including David A. Wheeler, Jason Dossett, Marcus Streets, Nicko van Someren, and Dan Kohn.  See [CREDITS])(https://github.com/linuxfoundation/cii-best-practices-badge/blob/master/CREDITS.md). The Linux Foundation could authorize others, if needed.  Thus, the project can continue even if any one person is incapacitated or killed.","bus_factor_status":"Met","bus_factor_justification":"David A. Wheeler, Jason Dossett, and Dan Kohn are all very familiar with the software and could easily continue its maintenance if necessary.  Many other people have contributed per [CREDITS](https://github.com/ossf/best-practices-badge/blob/main/CREDITS.md) and several of them could also probably maintain it if absolutely necessary. See [GitHub contributors statistics](https://github.com/ossf/best-practices-badge/graphs/contributors) for the latest statistics on contributors.","documentation_roadmap_status":"Met","documentation_roadmap_justification":"The [project roadmap](https://github.com/ossf/best-practices-badge/blob/main/docs/roadmap.md) explains these things.  Note that the project is in sustainment, so we're focusing more on continuous smaller improvements instead of massive changes.","documentation_architecture_status":"Met","documentation_architecture_justification":"The design is documented in [docs/implementation.md](https://github.com/ossf/best-practices-badge/blob/master/docs/implementation.md)","documentation_security_status":"Met","documentation_security_justification":"The security requirements and assurance case are documented in [docs/security.md](https://github.com/ossf/best-practices-badge/blob/main/docs/implementation.md).","documentation_quick_start_status":"Met","documentation_quick_start_justification":"The [docs/INSTALL.md](https://github.com/ossf/best-practices-badge/blob/main/docs/INSTALL.md) installation manual also includes \"quick start\" information to help someone get started.  In particular, it describes how to start up the program, access it via a web browser, become an administrator, and access its internal state to perform a few tasks.","documentation_current_status":"Met","documentation_current_justification":"We routinely update the documentation when a new capability is added.\r\n\r\nFor example, when the software was modified on 2017-05-27 to support a separate runtime configuration environment variable to set the database pool size (originally commit 8eef5e77ec5b08bc6714e2aa5a6139e71e55ff2b), by the next day (2017-05-28) in commit 1a8bcb5c5b40751ca874bd0b550f25a6aa8d7ea5 the documentation was modified to record it.","documentation_achievements_status":"Met","documentation_achievements_justification":"We record on our [homepage](https://github.com/ossf/best-practices-badge) that we have a CII best practices badge, good code coverage, and that we use CircleCI as our continuous integration (CI) system.","accessibility_best_practices_status":"Met","accessibility_best_practices_justification":"We generally follow accessibility best practices, e.g., we provide ALT values for images where relevant.\r\n\r\nWe use this website to find accessibility problems:\r\nhttps://achecker.ca/checker/index.php\r\nWe've checked the following paths (these are key forms in the system): \"/\", \"/signup\", \"/login\", \"/projects\", and \"/projects/1\".  There are no known problems and no likely problems.","internationalization_status":"Met","internationalization_justification":"The software is internationalized using standard [Ruby on Rails mechanisms](http://guides.rubyonrails.org/i18n.html).  This data is then sent on to the JavaScript code where appropriate.  We use translation.io to manage the translations.\r\n","sites_password_security_status":"Met","sites_password_security_justification":"We use [GitHub, who meet this criterion](https://help.github.com/articles/github-security/).","maintenance_or_update_status":"Met","maintenance_or_update_justification":"Normally only a single version of the product is in production use.  That said, it's important to handle upgrades, especially so that various developers can upgrade.  How to upgrade is documented in [CONTRIBUTING.md](https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md).\r\n\r\nHere is a summary of common cases:\r\n* Upgrading often involves a database migration, which is handled by running \"rake db:migration\" (if the user forgets to do this, it is detected, running stops, and this information is presented).\r\n* Other upgrades generally involve installing updated gems (libraries), which are handled with \"bundle update\".\r\n* In rare cases an update to the Ruby language is needed; the steps to do this are also in [CONTRIBUTING.md](https://github.com/linuxfoundation/cii-best-practices-badge/blob/master/CONTRIBUTING.md).","vulnerability_report_credit_status":"N/A","vulnerability_report_credit_justification":"We've never had an external bug reporter.\r\n\r\n[CONTRIBUTING.md](https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md) notes that:\r\n\r\n\u003e We will gladly give credit to anyone who reports a vulnerability so that we can fix it. If you want to remain anonymous or pseudonymous instead,  please let us know that; we will gladly respect your wishes.\r\n\r\nThis is emphasized in the vulnerability report handling process [docs/security.md](https://github.com/linuxfoundation/cii-best-practices-badge/blob/master/docs/implementation.md), where the last step is giving credit.","vulnerability_response_process_status":"Met","vulnerability_response_process_justification":"The vulnerability report handling process is documented in [docs/security.md](https://github.com/ossf/best-practices-badge/blob/main/docs/implementation.md).","coding_standards_status":"Met","coding_standards_justification":"[CONTRIBUTING.md](https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md) documents our coding style guides.\r\n\r\nAs documented there:\r\n* For Ruby on Rails, we generally follow the [community Ruby style guide](https://github.com/bbatsov/ruby-style-guide) and the complementary [community Rails style guide](https://github.com/bbatsov/rails-style-guide).\r\n* For JavaScript, our coding style is based on the [Node.js style guide](https://github.com/felixge/node-style-guide).","coding_standards_enforced_status":"Met","coding_standards_enforced_justification":"[CONTRIBUTING.md](https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md) documents our coding style enforcement mechanisms.\r\n\r\nAs documented there:\r\n* For Ruby on Rails, we use rubocop and rails_best_practices for style enforcement (as well as Brakeman to find vulnerabilities)\r\n* For JavaScript, we ESLint.","build_standard_variables_status":"N/A","build_standard_variables_justification":"The application does not create native binaries.  (Some of the libraries it depends on do, but those are external.)","build_preserve_debug_status":"N/A","build_preserve_debug_justification":"The application does not create native binaries.  (Some of the libraries it depends on do, but those are external.)","build_non_recursive_status":"N/A","build_non_recursive_justification":"The application does not create native binaries.  (Some of the libraries it depends on do, but those are external.)","build_repeatable_status":"N/A","build_repeatable_justification":"The application does not create native binaries.  (Some of the libraries it depends on do, but those are external.)  It is written in scripting languages where the source code is used directly.","installation_standard_variables_status":"N/A","installation_standard_variables_justification":"There is no installation system for build artifacts, as it's written using scripts.\r\n\r\nIt could be said that Rails builds web application assets (e.g., minified and concatenated JavaScript, and combined CSS); under that interpretation, they are written by the Rails framework as part of the execution of the Rails asset pipeline, and this is controlled in the usual way by controlling the framework.","installation_development_quick_status":"Met","installation_development_quick_justification":"The software is installed using standard conventions for this kind of software.  The underlying Ruby libraries are installed using bundler (the usual Ruby package manager).  Lower-level system components are normally installed using the system package manager.\r\n\r\nIt's possible to install these quickly, using a provided installation shell script that determines which system package manager to use \u0026 tries to automatically install whatever is needed, including the tests and test environment.  The instructions for quickly installing everything is in [INSTALL.md](https://github.com/ossf/best-practices-badge/blob/main/docs/INSTALL.md).","external_dependencies_status":"Met","external_dependencies_justification":"External dependencies are stored in a [Gemfile](https://github.com/ossf/best-practices-badge/blob/main/Gemfile).","dependency_monitoring_status":"Met","dependency_monitoring_justification":"External dependency checking is performed in two ways:\r\n\r\n* bundle_audit.  This checks all gems for known vulnerabilities.  This is run on every execution of the \"rake\" local check task and on every run of the continuous integration task on CircleCI.\r\n* GitHub (built-in dependency scanner).  This also checks gems for known vulnerabilities, and puts the current status on a badge that is displayed on the front page of the project home page.\r\n\r\nFor the few external dependencies that aren't managed as gems (e.g., PostgreSQL) the system package managers and/or the deployment system's managers are used to maintain them \u0026 periodically check them.","updateable_reused_components_status":"Met","updateable_reused_components_justification":"The project uses bundler, the standard package management solution for Ruby, for most externally-maintained components.  For the rest (e.g., PostgreSQL) it uses the system package manager.","interfaces_current_status":"Met","interfaces_current_justification":"We avoid depending on deprecated/obsolete functions.","automated_integration_testing_status":"Met","automated_integration_testing_justification":"We use [CircleCI](https://circleci.com/gh/ossf/best-practices-badge) to automatically test every check in to any branch in our repository.  I some circumstances experimental branches which do not yet run even in a development environment may be ignored via a custom entry in our circle.yml file.  The master, staging, and production  branches are always tested.","regression_tests_added50_status":"Met","regression_tests_added50_justification":"When regressions occur, we add tests for them.","test_statement_coverage80_status":"Met","test_statement_coverage80_justification":"As of this writing, we have 100% statement coverage, see [Codecov.io](https://codecov.io/gh/ossf/best-practices-badge).","test_policy_mandated_status":"Met","test_policy_mandated_justification":"Yes, this is a documented policy in [CONTRIBUTING.md](https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md) which says:\r\n\r\n\u003e When adding or changing functionality, please include new tests for them as part of your contribution.","implement_secure_design_status":"Met","implement_secure_design_justification":"They are implemented, as described in [docs/security.md](https://github.com/ossf/best-practices-badge/blob/main/docs/security.md).\r\n","input_validation_status":"Met","input_validation_justification":"All inputs from potentially untrusted sources are checked \u0026 rejected if they are invalid.  Some, such as justifications, only have a few limitations (must be UTF-8 and have a limited length). For more information, see [security.md](https://github.com/linuxfoundation/cii-best-practices-badge/blob/master/docs/security.md).","crypto_algorithm_agility_status":"N/A","crypto_algorithm_agility_justification":"This implements a web application, and the (external) web server determines what cryptographic algorithms are in use by the user.  If the web server supports multiple cryptographic algorithms (and it usually would), then the application does.  The functionality that calls out to other systems (e.g., OAUTH for GitHub, and data access for the detectives) are also external (and they support multiple algorithms anyway).","crypto_credential_agility_status":"Met","crypto_credential_agility_justification":"All authentication credentials can be provided via environment variables when run in production, so no useful key is stored in the source code.","signed_releases_status":"N/A","signed_releases_justification":"Releases are not intended for widespread use in many different sites, so this is N/A.\r\n","version_tags_signed_status":"Unmet","version_tags_signed_justification":"In production the software is run in a single site, so the need for signed versions is less.","badge_percentage_2":100,"contributors_unassociated_status":"Met","contributors_unassociated_justification":"There are [at least 22 contributors](https://github.com/ossf/best-practices-badge/graphs/contributors), and at least three significant contributors today: David A. Wheeler (IDA), Jason Dossett (IDA), and Dan Kohn (Linux Foundation).  For this work, IDA works for the Core Infrastructure Initiative (CII), which is a project of the Linux Foundation (LF). However, the LF is itself a [nonprofit mutual benefit corporation (specifically a Section 501(c)(6))](https://www.linuxfoundation.org/bylaws/).  As a nonprofit mutual benefit corporation, the LF is directed by other organizations which actually provide funding to do this work, and thus the LF and CII can be viewed as \"pass through\" organizations as described in this criterion.\r\n","copyright_per_file_status":"Met","copyright_per_file_justification":"Each source file has a copyright statement in its header.  See [CONTRIBUTING.md](https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md) for the instructions for Ruby (nearly all source files are in Ruby).","license_per_file_status":"Met","license_per_file_justification":"Each source file has a copyright statement in its header (MIT).  See [CONTRIBUTING.md](https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md) for the instructions for Ruby source files (nearly all source files are in Ruby).","small_tasks_status":"Met","small_tasks_justification":"We use the \"up-for-grabs\" tag.  This is noted on the [front page of the repo](https://github.com/coreinfrastructure/best-practices-badge).","require_2FA_status":"Met","require_2FA_justification":"The Core Infrastructure Initiative (CII) requires two-factor authentication for all organization members and outside collaborators as described in [Requiring two-factor authentication in your organization](https://help.github.com/articles/requiring-two-factor-authentication-in-your-organization/).","secure_2FA_status":"Met","secure_2FA_justification":"Project governance specifically documents that SMS is not acceptable; see [governance.md](https://github.com/ossf/best-practices-badge/blob/main/docs/governance.md).","code_review_standards_status":"Met","code_review_standards_justification":"The file [CONTRIBUTING.md](https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md) describes the code review requirements.  E.G., changes to the code built on Rails must follow the [Rails community style guide](https://github.com/bbatsov/rails-style-guide).  The continuous integration tasks run a large number of checks, e.g., all Ruby code must go through Rubocop, and all JavaScript code must go through ESLint (with the given conditions).  We absolutely require that the Ruby code have at least 90% statement coverage, but we typically don't accept statement coverage less than 100%.","two_person_review_status":"Met","two_person_review_justification":"We have a policy in [CONTRIBUTING.md](https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md) that modifications other than low-risk modifications be reviewed by someone else, and a stated goal of having at least 50% of all proposed modifications to be reviewed.","test_statement_coverage90_status":"Met","test_statement_coverage90_justification":"As of this writing, we have 100% statement coverage, see [Codecov.io](https://codecov.io/gh/ossf/best-practices-badge).","test_branch_coverage80_status":"N/A","test_branch_coverage80_justification":"There are no top-to-bottom FLOSS tools available in Ruby which can measure branch coverage.   Ruby version 2.5 was the first version that enabled capturing branch coverage, and it was only released on 2017-12-25.  Other tools on top of Ruby need to be modified so that they can use this information, e.g., [simplecov issue 412](https://github.com/colszowka/simplecov/issues/412) proposed adding branch coverage support to simplecov.","security_review_status":"Met","security_review_justification":"We have performed a self-assessment of our security, and it is documented in [security.md](https://github.com/ossf/best-practices-badge/blob/main/doc/security.md).  This considered the security requirements and security boundary, and examined the high-level architecture.  We used static \u0026 dynamic tools, as well as human review (especially of the major design components).  This was *not* an independent evaluation, but the criterion doesn't require that.","assurance_case_status":"Met","assurance_case_justification":"The security requirements and assurance case are documented in [docs/security.md](https://github.com/ossf/best-practices-badge/blob/main/docs/implementation.md).","achieve_passing_status":"Met","achieve_silver_status":"Met","tiered_percentage":300,"repo_url_updated_at":"2026-07-18T03:38:32.274Z","achieved_silver_at":"2023-09-19T06:10:30.864Z","lost_silver_at":"2023-09-19T06:10:11.390Z","achieved_gold_at":"2023-09-19T06:10:30.864Z","lost_gold_at":"2023-09-19T06:10:11.390Z","first_achieved_passing_at":"2016-01-12T22:55:00.000Z","first_achieved_silver_at":"2023-09-07T18:29:54.722Z","first_achieved_gold_at":"2023-09-07T18:29:54.722Z","maintained_status":"Met","OSPS-AC-01.01_status":"Met","OSPS-AC-01.01_justification":"The authoritative repository is hosted on GitHub, which requires multi-factor authentication to modify sensitive resources or to read sensitive resources like keys. GitHub allows anyone to read publicly available resources (such as the source code), and that's fine.","OSPS-AC-02.01_status":"Met","OSPS-AC-02.01_justification":"New collaborators are only given lowest available privileges. We generally don't add many collaborators who can directly edit the software, but instead ask people to fork the repository and create pull requests from them, which gives them *no* privileges by default.","OSPS-AC-03.01_status":"Met","OSPS-AC-03.01_justification":"Our main branch is protected (it's named `main`).","OSPS-AC-03.02_status":"Met","OSPS-AC-03.02_justification":"GitHub requires this.","OSPS-BR-01.01_status":"Met","OSPS-BR-01.01_justification":"Other the branch name we don't use input parameters. See below in OSPS-BR-01.02 for branch names.","OSPS-BR-01.02_status":3,"OSPS-BR-01.02_justification":"Branch names are checked before they are used *if* they are used. Note that the scorecard workflow doesn't use the branch name, so it doesn't check it easier (we can't add that check because the scorecard workflow is only allowed to do certain things).","OSPS-BR-03.01_status":"Met","OSPS-BR-03.01_justification":"https: is always used.","OSPS-BR-03.02_status":"Met","OSPS-BR-03.02_justification":"https: is always used.","OSPS-BR-07.01_status":"Met","OSPS-BR-07.01_justification":"We enable secret scanning to prevent this.","OSPS-DO-01.01_status":"N/A","OSPS-DO-01.01_justification":"The project doesn't create \"releases\" for many to download and install. Its primary purpose is to be a specific website's implementation. Therefore, it must be completely usable without any \"user guides\" for end users (who spend relatively little time on the site). We do have guides for setting up and running the site, primarily to enable others to install it so they can add features to it as proposals.","OSPS-DO-02.01_status":"Met","OSPS-DO-02.01_justification":"See SECURITY.md for how to report defects.","OSPS-GV-02.01_status":"Met","OSPS-GV-02.01_justification":"GitHub provides issues and pull requests. We also use a mailing list.","OSPS-GV-03.01_status":"Met","OSPS-GV-03.01_justification":"See CONTRIBUTING.md.","OSPS-LE-02.01_status":"Met","OSPS-LE-02.01_justification":"We use the MIT license, which meets the OSI Open Source Definition and the Free Software Definition.","OSPS-LE-02.02_status":"Met","OSPS-LE-02.02_justification":"We use the MIT license, which meets the OSI Open Source Definition and the Free Software Definition.","OSPS-LE-03.01_status":"Met","OSPS-LE-03.01_justification":"See file LICENSE for the source code.","OSPS-LE-03.02_status":"Met","OSPS-LE-03.02_justification":"See file LICENSE for the source code.","OSPS-QA-01.01_status":"Met","OSPS-QA-01.02_status":"Met","OSPS-QA-02.01_status":"Met","OSPS-QA-04.01_status":"Met","OSPS-QA-05.01_status":"Met","OSPS-QA-05.02_status":"Met","OSPS-VM-02.01_status":"Met","OSPS-AC-04.01_status":"Met","OSPS-AC-04.01_justification":"All CI/CD except 1 have no special privileges, and thus can't do anything special.\r\n\r\nThe CircleCI \"deploy\" task *does* have a special permission: the secret key for deployment. This is only run after all verification steps pass, and only on the \"staging\" and \"production\" branches, which are protected branches that *cannot* be pushed to normally (changing their contents requires extra privileges).","OSPS-BR-02.01_status":"Met","OSPS-BR-02.01_justification":"The primary single user uses git commit records to identify releases. [version_unique]","OSPS-BR-04.01_status":"Met","OSPS-BR-04.01_justification":"CHANGELOG file is in top directory, see: https://github.com/linuxfoundation/cii-best-practices-badge/blob/master/CHANGELOG.md [release_notes]","OSPS-BR-05.01_status":"Met","OSPS-BR-05.01_justification":"External dependencies are stored in a [Gemfile](https://github.com/linuxfoundation/cii-best-practices-badge/blob/master/Gemfile). [external_dependencies]","OSPS-BR-06.01_status":"N/A","OSPS-BR-06.01_justification":"Releases are not intended for widespread use in many different sites, so this is N/A. [signed_releases]","OSPS-DO-06.01_status":"Met","OSPS-DO-06.01_justification":"Our key documentation is in CONTRIBUTING.md. Selection is discussed in the [reuse (supply chain)[https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md#reuse-supply-chain) section. As documented there, we use package managers to obtain and track dependencies. We also use bundle-audit and dependabot to alert us to vulnerabilities in dependencies.","OSPS-GV-01.01_status":"Met","OSPS-GV-01.01_justification":"See docs/TSC.md","OSPS-GV-01.02_status":"Met","OSPS-GV-01.02_justification":"The document [docs/governance.md](https://github.com/ossf/best-practices-badge/blob/main/docs/governance.md) describes the key roles, which are basically \"technical lead\" and \"others with commit rights\".  It also identifies who has those roles. [roles_responsibilities]","OSPS-GV-03.02_status":"Met","OSPS-GV-03.02_justification":"https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md [contribution_requirements]","OSPS-LE-01.01_status":"Met","OSPS-LE-01.01_justification":"We require a DCO for contributions, as documented in https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md which says:\r\n\r\n\u003e All contributions (including pull requests) must agree to the [Developer Certificate of Origin (DCO) version 1.1](docs/dco.txt).\r\nThis is exactly the same one created and used by the Linux kernel developers and posted on \u003chttp://developercertificate.org/\u003e. This is a developer's certification that he or she has the right to submit the patch for inclusion into the project. [dco]","OSPS-QA-03.01_status":"Met","OSPS-QA-03.01_justification":"We use [CircleCI](https://circleci.com/gh/ossf/best-practices-badge) to automatically test every check in to any branch in our repository.  I some circumstances experimental branches which do not yet run even in a development environment may be ignored via a custom entry in our circle.yml file.  The master, staging, and production  branches are always tested. [automated_integration_testing]","OSPS-QA-06.01_status":"Met","OSPS-QA-06.01_justification":"We use [CircleCI](https://circleci.com/gh/ossf/best-practices-badge) to automatically test every check in to any branch in our repository.  I some circumstances experimental branches which do not yet run even in a development environment may be ignored via a custom entry in our circle.yml file.  The master, staging, and production  branches are always tested. [automated_integration_testing]","OSPS-SA-01.01_status":"Met","OSPS-SA-01.01_justification":"The design is documented in [docs/implementation.md](https://github.com/ossf/best-practices-badge/blob/main/docs/implementation.md) [documentation_architecture]","OSPS-SA-02.01_status":"Met","OSPS-SA-02.01_justification":"Its interface is defined here: https://github.com/ossf/best-practices-badge/blob/main/doc/implementation.md#interface [documentation_interface]","OSPS-SA-03.01_status":"Met","OSPS-SA-03.01_justification":"The security requirements and assurance case are documented in [docs/security.md](https://github.com/ossf/best-practices-badge/blob/main/docs/implementation.md). [assurance_case]","OSPS-VM-01.01_status":"Met","OSPS-VM-01.01_justification":"https://github.com/ossf/best-practices-badge/issues [vulnerability_report_process]","OSPS-VM-03.01_status":"Met","OSPS-VM-03.01_justification":"https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md [vulnerability_report_private]","OSPS-VM-04.01_status":"Met","OSPS-VM-04.01_justification":"We intend to do that, though we don't know of any for-certain publicly known vulnerabilities.\r\n\r\nOur release notes do document that commit fdb83380 on 2015-11-26 updated gem nokogiri from 1.6.6.2 to 1.6.6.4 due to CVE-2015-1819.  It's not clear if our application was actually vulnerable; it was easier to simply upgrade.  In any case, we upgraded immediately, and this is documented in our release notes. [release_notes_vulns]","OSPS-AC-04.02_status":"Met","OSPS-AC-04.02_justification":"The only job assigned special permissions is the special deployment task. All others only have the privileges necessary to download the code, install tools locally in that container, and run the tools to determine and report analysis results.","OSPS-BR-02.02_status":"Met","OSPS-BR-02.02_justification":"The primary single user uses git commit records to identify releases. [version_unique]","OSPS-BR-07.02_status":"Met","OSPS-BR-07.02_justification":"See docs/secrets-policy.md for the policy and processes for managing secret/credentials, including rotating them.","OSPS-DO-03.01_status":"N/A","OSPS-DO-03.01_justification":"Releases are not intended for widespread use in many different sites, so this is N/A. [signed_releases]","OSPS-DO-03.02_status":"N/A","OSPS-DO-03.02_justification":"Releases are not intended for widespread use in many different sites, so this is N/A. [signed_releases]","OSPS-DO-04.01_status":"N/A","OSPS-DO-04.01_justification":"Our releases are intended for use in a single website that we maintain, and the support ends when we update the production branch.","OSPS-DO-05.01_status":"N/A","OSPS-DO-05.01_justification":"As the intended use is a single website, we simply stop updating all previous versions, and only support the current version.","OSPS-GV-04.01_status":"Met","OSPS-GV-04.01_justification":"See docs/governance.md especially our \"Escalated permissions policy\". This updated policy was approved by the Best Practices Badge TSC in 2026.","OSPS-QA-02.02_status":"Met","OSPS-QA-02.02_justification":"See `docs/sbom.md`. Every time we push to the `staging` or `production` branch, as part of the build process we generate an SPDX SBOM and record it. We provide a script `scripts/get-sbom` to make it easy to acquire the SBOM information given a commit ID. Commits to `production` are the closest thing we have to a \"release\". We also document the REST API for retrieving a SPDX SBOM of the *current* main branch, though that isn't really a release.","OSPS-QA-04.02_status":"N/A","OSPS-QA-04.02_justification":"We don't use multiple source code repositories for the project.","OSPS-QA-06.02_status":"Met","OSPS-QA-06.02_justification":"Yes, it includes a test suite based on minitest (the test framework that comes with Rails). [test]","OSPS-QA-06.03_status":"Met","OSPS-QA-06.03_justification":"Yes, this is a documented policy in [CONTRIBUTING.md](https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md) which says:\r\n\r\n\u003e When adding or changing functionality, please include new tests for them as part of your contribution. [test_policy_mandated]","OSPS-QA-07.01_status":"Met","OSPS-QA-07.01_justification":"We have a policy in [CONTRIBUTING.md](https://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md) that modifications other than low-risk modifications be reviewed by someone else, and a stated goal of having at least 50% of all proposed modifications to be reviewed. [two_person_review]","OSPS-SA-03.02_status":"Met","OSPS-SA-03.02_justification":"The security requirements and assurance case are documented in [docs/security.md](https://github.com/ossf/best-practices-badge/blob/main/docs/implementation.md). [assurance_case]","OSPS-VM-04.02_status":"N/A","OSPS-VM-04.02_justification":"We don't have any known vulnerabilities in components we use. When a dependency has a vulnerability, we generally simply update it to a not-vulnerable version, even if we believe it won't affect us, because that's a stronger defense than a possibly-flawed analysis.","OSPS-VM-05.01_status":"Met","OSPS-VM-05.01_justification":"External dependency checking is performed in two ways:\r\n\r\n* bundle_audit.  This checks all gems for known vulnerabilities.  This is run on every execution of the \"rake\" local check task and on every run of the continuous integration task on CircleCI.\r\n* [Gemnasium](https://gemnasium.com/linuxfoundation/cii-best-practices-badge).  This also checks gems for known vulnerabilities, and puts the current status on a badge that is displayed on the front page of the project home page.\r\n\r\nFor the few external dependencies that aren't managed as gems (e.g., PostgreSQL) the system package managers and/or the deployment system's managers are used to maintain them \u0026 periodically check them. [dependency_monitoring]","OSPS-VM-05.02_status":"Met","OSPS-VM-05.02_justification":"External dependency checking is performed in two ways:\r\n\r\n* bundle_audit.  This checks all gems for known vulnerabilities.  This is run on every execution of the \"rake\" local check task and on every run of the continuous integration task on CircleCI.\r\n* [Gemnasium](https://gemnasium.com/linuxfoundation/cii-best-practices-badge).  This also checks gems for known vulnerabilities, and puts the current status on a badge that is displayed on the front page of the project home page.\r\n\r\nFor the few external dependencies that aren't managed as gems (e.g., PostgreSQL) the system package managers and/or the deployment system's managers are used to maintain them \u0026 periodically check them. [dependency_monitoring]","OSPS-VM-05.03_status":"Met","OSPS-VM-05.03_justification":"External dependency checking is performed in two ways:\r\n\r\n* bundle_audit.  This checks all gems for known vulnerabilities.  This is run on every execution of the \"rake\" local check task and on every run of the continuous integration task on CircleCI.\r\n* [Gemnasium](https://gemnasium.com/linuxfoundation/cii-best-practices-badge).  This also checks gems for known vulnerabilities, and puts the current status on a badge that is displayed on the front page of the project home page.\r\n\r\nFor the few external dependencies that aren't managed as gems (e.g., PostgreSQL) the system package managers and/or the deployment system's managers are used to maintain them \u0026 periodically check them. [dependency_monitoring]","OSPS-VM-06.01_status":"Met","OSPS-VM-06.01_justification":"This is vacuously true, since we've had no reports of vulnerabilities that apply to a deployed system. [static_analysis_fixed]","OSPS-VM-06.02_status":"Met","OSPS-VM-06.02_justification":"As noted in \u003chttps://github.com/ossf/best-practices-badge/blob/main/CONTRIBUTING.md\u003e, Brakeman, Rubocop, and rails_best_practices are used to analyze the Ruby code.  Brakeman is specifically designed to analyze Ruby on Rails code.  The Javascript client-side code is analyzed with ESLint, using over 100 rules.\r\n\r\nThese analysis tools are used as part of the default 'rake' process used in local development, as well as the \"pronto\" process run on the continuous integration server running on CircleCI. [static_analysis]","badge_percentage_baseline_1":100,"badge_percentage_baseline_2":100,"badge_percentage_baseline_3":100,"achieved_baseline_1_at":"2025-12-27T00:39:14.103Z","achieved_baseline_2_at":"2026-04-01T21:28:30.835Z","achieved_baseline_3_at":"2026-04-03T22:31:58.389Z","lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":"2025-12-27T00:39:14.103Z","first_achieved_baseline_2_at":"2026-04-01T21:28:30.835Z","first_achieved_baseline_3_at":"2026-04-03T22:31:58.389Z","baseline_tiered_percentage":300,"entry_locale":"en","passing_saved":true,"silver_saved":true,"gold_saved":true,"baseline_1_saved":true,"baseline_2_saved":true,"baseline_3_saved":true,"OSPS-BR-01.03_status":"Met","OSPS-BR-01.03_justification":"Unreviewed code (PRs) runs in the low-privilege pull_request context with no secrets and read-only tokens; the workflows that hold write credentials at *all* only run on code that has already been reviewed and merged:\r\n\r\n1. pull_request (not pull_request_target) is used for untrusted code. The two workflows that trigger on pull requests (main.yml and codespell.yml) both\r\n  use the pull_request event trigger. GitHub Actions automatically denies access\r\n   to repository secrets and grants only a read-only, ephemeral GITHUB_TOKEN to\r\n  workflows triggered this way from forks. No secrets can leak to an external\r\n  contributor's PR. Neither workflow uses pull_request_target, which is the\r\n  primary vector by which CI/CD systems accidentally expose privileged\r\n  credentials to unreviewed code.\r\n2. Minimal declared permissions on PR-triggered workflows. Both main.yml and\r\n  codespell.yml declare permissions: contents: read at the top level, so even   \r\n  the ephemeral GITHUB_TOKEN is scoped to the minimum needed. Because GitHub's\r\n  permissions: key defaults anything not listed to none, there are no implicit  \r\n  write permissions available.\r\n3. Privileged workflows never trigger on pull requests. The only workflow with\r\n   elevated permissions (sbom.yml, which requires contents: write to create     \r\n  GitHub Releases) is gated exclusively on push to the staging or production\r\n   branches that only receive reviewed, merged code. It never runs on \r\n  a PR. Similarly, scorecard.yml only triggers on push to main, a scheduled\r\n  cron, and branch_protection_rule events.\r\n4. persist-credentials: false on privileged checkouts. The sbom.yml workflow\r\n  additionally sets persist-credentials: false on actions/checkout, ensuring git\r\n   credentials are not stored in the workspace even after checkout, limiting\r\n  lateral movement if a downstream step were compromised.","OSPS-DO-07.01_status":"Met","OSPS-DO-07.01_justification":"The software is installed using standard conventions for this kind of software.  The underlying Ruby libraries are installed using bundler (the usual Ruby package manager).  Lower-level system components are normally installed using the system package manager.\r\n\r\nIt's possible to install these quickly, using a provided installation shell script that determines which system package manager to use \u0026 tries to automatically install whatever is needed, including the tests and test environment.  The instructions for quickly installing everything is in [INSTALL.md](https://github.com/linuxfoundation/cii-best-practices-badge/blob/master/docs/INSTALL.md). [installation_development_quick]","OSPS-BR-01.04_status":"Met","OSPS-BR-01.04_justification":"None of the three CI/CD workflows (.github/workflows/main.yml, codespell.yml, scorecard.yml) define any workflow_dispatch inputs or other explicit collaborator-triggered input parameters. All workflows trigger only on automated events (push, pull_request, schedule, branch_protection_rule).\r\n\r\nSince there are no manual workflow inputs to sanitize, the criterion is vacuously satisfied — there is no attack surface of this type to protect.\r\n\r\nSupporting evidence:\r\n\r\n - grep for workflow_dispatch across all workflow files returns zero  matches.\r\n - The existing input validation (OSPS-BR-01.02's  script/validate_branch_name) handles environment-provided values like GITHUB_REF_NAME, which is a different concern (automated trigger context, not collaborator-supplied input).\r\n\r\nConclusion: The project meets OSPS-BR-01.04 because it has no pipelines that\r\naccept trusted-collaborator input (no workflow_dispatch with inputs, no\r\nmanual triggers with parameters). If such inputs are added in the future,\r\nthey would need to be validated before use.","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"gold","additional_rights":[],"project_entry_attribution":"Please credit David A. Wheeler and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"},{"id":24,"user_id":38,"name":"Zed Attack Proxy (ZAP)","description":"Zed Attack Proxy (ZAP) is an easy to use integrated penetration testing tool for finding vulnerabilities in web applications.  It is designed to be used by people with a wide range of security experience and as such is ideal for developers and functional testers who are new to penetration testing.  ZAP provides automated scanners as well as a set of tools that allow you to find security vulnerabilities manually.","homepage_url":"https://www.zaproxy.org","repo_url":"https://github.com/zaproxy/zaproxy","license":"Apache-2.0","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","description_good_status":"Met","interact_status":"Met","interact_justification":"https://github.com/zaproxy/zaproxy/blob/main/CONTRIBUTING.md","contribution_status":"Met","contribution_justification":"See https://github.com/zaproxy/zaproxy/wiki/GetInvolved and https://github.com/zaproxy/zaproxy/wiki/Contributing-Changes","contribution_requirements_status":"Met","contribution_requirements_justification":"https://www.zaproxy.org/docs/developer/dev-rules-and-guidelines/","license_location_status":"Met","license_location_justification":"License is in top-level directory file \u003chttps://github.com/zaproxy/zaproxy/blob/main/LICENSE\u003e.","floss_license_status":"Met","floss_license_justification":"The Apache-2.0 license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The Apache-2.0 license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"Met","documentation_basics_justification":"See https://www.zaproxy.org ; ZAP includes help documentation and user guide, and the wiki provides additional documentation.","documentation_interface_status":"Met","documentation_interface_justification":"See https://github.com/zaproxy/zaproxy/wiki/DevExtending and https://github.com/zaproxy/zaproxy/wiki/ApiDetails\r\n","repo_public_status":"Met","repo_public_justification":"See https://github.com/zaproxy/zaproxy/","repo_track_status":"Met","repo_track_justification":"The ChangeLogs are linked-to from https://www.zaproxy.org/docs/desktop/releases/ . Detailed change history is also available via\r\n https://github.com/zaproxy/zaproxy/commits/main and https://github.com/zaproxy/zap-extensions/commits/main\r\n Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"Met","repo_distributed_status":"Met","repo_distributed_justification":"Uses git. Repository on GitHub, which uses git. Git is distributed. Repository on GitHub, which uses git. git is distributed.","version_unique_status":"Met","version_unique_justification":"An example version number is \"2.4.3\".  Since 2.4.0 it has used semantic versioning; see https://github.com/zaproxy/zaproxy/blob/main/src/org/zaproxy/zap/Version.java","version_semver_status":"Met","version_tags_status":"Met","version_tags_justification":"git tags are used to tag release versions, e.g., \"2.4.3\".  See https://github.com/zaproxy/zaproxy/tree/main","release_notes_status":"Met","release_notes_justification":"Full details of all releases are included in the ZAP User Guide which is included with ZAP and available online: https://www.zaproxy.org/docs/desktop/releases/","release_notes_vulns_status":"Met","release_notes_vulns_justification":"Yes, for an example see: https://www.zaproxy.org/docs/desktop/releases/2.11.0/","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"GitHub issue tracker https://github.com/zaproxy/zaproxy/issues","report_process_status":"Met","report_process_justification":"The page https://www.zaproxy.org/community/ provides an overview. It states that bug reports (and feature suggestions) are to be submitted via https://github.com/zaproxy/zaproxy/issues","report_responses_status":"Met","enhancement_responses_status":"Met","report_archive_status":"Met","report_archive_justification":"GitHub issue tracker at https://github.com/zaproxy/zaproxy/issues","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"https://github.com/zaproxy/zaproxy/blob/main/CONTRIBUTING.md#found-a-vulnerability","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"https://github.com/zaproxy/zaproxy/blob/main/CONTRIBUTING.md#found-a-vulnerability","vulnerability_report_response_status":"Met","build_status":"Met","build_justification":"A build summary is here: https://github.com/zaproxy/zaproxy/blob/main/BUILDING.md . Developer documentation is available via: https://www.zaproxy.org/docs/developer/\r\n","build_common_tools_status":"Met","build_common_tools_justification":"The recommended build tools include Eclipse IDE for Java Developers and a Java development environment. The builds are done via Gradle, which is a common tool for Java programs; see: https://github.com/zaproxy/zaproxy/blob/main/BUILDING.md","build_floss_tools_status":"Met","build_floss_tools_justification":"The ZAP core team and other community contributors build ZAP and related components on various platforms regularly using FLOSS tools.","test_status":"Met","test_justification":"https://github.com/zaproxy/zaproxy/wiki/Testing","test_invocation_status":"Met","test_invocation_justification":"The existing unit tests use JUnit and are executable in both IDEs and via Gradle.\r\nhttps://www.zaproxy.org/docs/developer/dev-rules-and-guidelines/\r\nhttps://github.com/zaproxy/zaproxy\r\nhttps://github.com/zaproxy/zap-extensions","test_most_status":"Unmet","test_most_justification":"No evidence found that most of the code is covered by current tests.","test_policy_status":"Met","test_policy_justification":"This is documented in https://github.com/zaproxy/zaproxy/wiki/DevGuidelines","tests_are_added_status":"Met","tests_are_added_justification":"We run ZAP against test applications like wavsep and wivet regularly: http://zapbot.github.io/zap-mgmt-scripts/scans.html\r\nThe team continues to improve test coverage.","tests_documented_added_status":"Met","tests_documented_added_justification":"Included in https://www.zaproxy.org/docs/developer/dev-rules-and-guidelines/ : \"Where possible all developments should include regression tests. There are not enough at the moment, and we need to change that.\"","warnings_status":"Met","warnings_justification":"The -Xlint flag is enabled from this PR: https://github.com/zaproxy/zaproxy/pull/2459#issuecomment-218164726","warnings_fixed_status":"Met","warnings_fixed_justification":"All -Xlint warning fixed from https://github.com/zaproxy/zaproxy/pull/2459#issuecomment-218164726 and build fails if new warnings occur","warnings_strict_status":"Met","warnings_strict_justification":"The -Xlint and -Werror options ensures the build task fails if any warnings occur","know_secure_design_status":"Met","know_secure_design_justification":"The tool itself is focused on finding vulnerabilities. The project leader is Simon Bennetts (a.k.a. Psiinon), who has held various positions pertaining to development of secure software and systems (https://www.linkedin.com/in/psiinon/).","know_common_errors_status":"Met","know_common_errors_justification":"The project leader is Simon Bennetts (a.k.a. Psiinon).  He is joint project lead of the \"OWASP Vulnerable Web Applications Directory Project\", project lead of the \"Bodge It Store\" (an intentionally vulnerable web application used for testing), and joint author of the \"OWASP Web Application Security Testing Cheat Sheet\".","crypto_published_status":"N/A","crypto_call_status":"N/A","crypto_floss_status":"N/A","crypto_keylength_status":"N/A","crypto_working_status":"N/A","crypto_pfs_status":"N/A","crypto_password_storage_status":"N/A","crypto_random_status":"Met","crypto_random_justification":"ZAP generates a per user root CA cert using standard libraries (Bouncy Castle).","delivery_mitm_status":"Met","delivery_mitm_justification":"Executables downloaded using HTTPS, see: https://www.zaproxy.org/download/","delivery_unsigned_status":"Met","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_fixed_60_days_justification":"We do not know of any unpatched vulnerabilities.","vulnerabilities_critical_fixed_status":"Met","vulnerabilities_critical_fixed_justification":"We do not know of any unpatched vulnerabilities.","static_analysis_status":"Met","static_analysis_justification":"We use SonarCloud to analyze ZAP's source code weekly. As well as recommending that Developers use Sonar Lint within their IDE.","static_analysis_common_vulnerabilities_status":"Met","static_analysis_common_vulnerabilities_justification":"https://sonarcloud.io/organizations/zaproxy/projects","static_analysis_fixed_status":"Met","static_analysis_fixed_justification":"We do not think that any of the issues reported are exploitable.","static_analysis_often_status":"Unmet","static_analysis_often_justification":"We are now performing static source code analysis weekly","dynamic_analysis_status":"Unmet","dynamic_analysis_justification":"ZAP is itself a dynamic analysis tool, and can even be invoked by other tools, but there's no evidence found that there's another dynamic tool applied against it.","dynamic_analysis_unsafe_status":"N/A","dynamic_analysis_unsafe_justification":"ZAP is written in Java, so this is N/A.","dynamic_analysis_enable_assertions_status":"Unmet","dynamic_analysis_fixed_status":"Met","dynamic_analysis_fixed_justification":"No publicly known vulnerabilities.","general_comments":"","created_at":"2015-10-26T14:45:46.538Z","updated_at":"2024-01-29T09:51:31.443Z","crypto_weaknesses_status":"N/A","test_continuous_integration_status":"Met","test_continuous_integration_justification":"GitHub actions are used to build and run unit tests on all commits and PR's. The build status is included as a badge on https://github.com/zaproxy/zaproxy#-zap","cpe":"","discussion_status":"Met","discussion_justification":"GitHub issue tracker and pull requests support discussion","no_leaked_credentials_status":"Met","english_status":"Met","hardening_status":"Met","hardening_justification":"There is a Bug Bounty program which covers ZAP itself and the primary web site.\r\nRegular SAST assessments are conducted against the code base.\r\nhttps://sonarcloud.io/organizations/zaproxy/projects","crypto_used_network_status":"Met","crypto_used_network_justification":"Where applicable the user is able to select their desired support for TLS protocol version etc. (As of the current update this means support for TLS 1.3, and whatever hashing algorithms are supported by the JRE in use.)","crypto_tls12_status":"Met","crypto_tls12_justification":"ZAP needs to connect to any website it needs to test, so it supports TLS 1, 1.1, 1.2, and 1.3. Users can enable and disable each, and their use depends on the support of the given JVM.","crypto_certificate_verification_status":"Met","crypto_certificate_verification_justification":"As ZAP is a MitM there are circumstances where this is true and where it is false, however the documentation should make said situations clear.","crypto_verification_private_status":"Met","crypto_verification_private_justification":"As ZAP is a MitM there are circumstances where this is true and where it is false, however the documentation should make said situations clear.","hardened_site_status":"Unmet","hardened_site_justification":"CSP is the only thing missing. The site is static and there is no login.\r\nhttps://www.zaproxy.org/ // One or more of the required security hardening headers is missing.","installation_common_status":"Met","installation_common_justification":"The Windows version comes with a standard installer and uninstaller, the OSX version is packages as an OSX app and the linux / cross platform versions are just tar / zip","build_reproducible_status":"Met","build_reproducible_justification":"ZAP and it's add-ons are produced through automated builds, which are easily reproducible:\r\nhttps://github.com/zaproxy/zaproxy\r\nhttps://github.com/zaproxy/zap-extensions","badge_percentage_0":100,"achieved_passing_at":"2016-08-10T07:03:00.000Z","lost_passing_at":null,"last_reminder_at":null,"disabled_reminders":false,"implementation_languages":"Java, JavaScript, PHP","lock_version":42,"badge_percentage_1":98,"dco_status":"Met","dco_justification":"All ZAP PRs require that a DCO check be passed. https://github.com/zaproxy/zaproxy/pulls","governance_status":"Met","governance_justification":"https://www.zaproxy.org/docs/contribute/roles-and-governance/","code_of_conduct_status":"Met","code_of_conduct_justification":"https://github.com/zaproxy/zaproxy/blob/develop/CODE_OF_CONDUCT.md","roles_responsibilities_status":"Met","roles_responsibilities_justification":"https://www.zaproxy.org/docs/contribute/roles-and-governance/\r\nhttps://www.zaproxy.org/docs/contribute/core-team/","access_continuity_status":"Met","access_continuity_justification":"2 individuals, (github usernames) psiinon and thc202 have admin access to all sites and services used for the ZAP project.\r\nhttps://www.zaproxy.org/docs/desktop/credits/#zap-core-team-current","bus_factor_status":"Met","bus_factor_justification":"https://www.zaproxy.org/docs/desktop/credits/#zap-core-team-current","documentation_roadmap_status":"Met","documentation_roadmap_justification":"https://www.zaproxy.org/docs/roadmap/","documentation_architecture_status":"Met","documentation_architecture_justification":"https://github.com/zaproxy/zaproxy/wiki/InternalDetails","documentation_security_status":"Met","documentation_security_justification":"https://github.com/zaproxy/zaproxy/blob/main/SECURITY.md","documentation_quick_start_status":"Met","documentation_quick_start_justification":"https://www.zaproxy.org/getting-started/\r\nhttps://www.zaproxy.org/pdf/ZAPGettingStartedGuide-2.11.pdf","documentation_current_status":"Met","documentation_current_justification":"Help is updated in applicable PRs, hosted online, and in some cases automatically generated.\r\nhttps://www.zaproxy.org/docs/","documentation_achievements_status":"Met","documentation_achievements_justification":"https://github.com/zaproxy/zaproxy#-owasp-zap","accessibility_best_practices_status":"Met","accessibility_best_practices_justification":"The web site and documentation are straight-forward text-based and don't require fancy UI things. Also using high contrast colors and avoids using images for explanations etc.\r\nFor ZAP itself we are working towards more accessibility friendly items on an on-going basis.","internationalization_status":"Met","internationalization_justification":"The whole ZAP code base is internationalized, with translations provided via https://crowdin.com/project/owasp-zap and https://crowdin.com/project/owasp-zap-help","sites_password_security_status":"N/A","sites_password_security_justification":"None of our sites provide an option for user authentication","maintenance_or_update_status":"N/A","maintenance_or_update_justification":"The N-1 version of the product is supported but users are strongly encouraged to stay on the Nth version as we are a very small team. Upgrade instructions shouldn't be necessary but are provided in our documentation.","vulnerability_report_credit_status":"Met","vulnerability_report_credit_justification":"Where agreed with the reporter vulnerabilities identification/resolution is attributed. Per blog posts, release notes, and our BugCrowd use.\r\nhttps://www.zaproxy.org","vulnerability_response_process_status":"Met","vulnerability_response_process_justification":"Documentent on https://github.com/zaproxy/zaproxy#-owasp-zap with a link to the ZAP bug bounty program https://bugcrowd.com/owaspzap","coding_standards_status":"Met","coding_standards_justification":"A style is preferred and enforced.facilitated by the build processes/tooling.\r\nhttps://www.zaproxy.org/docs/developer/","coding_standards_enforced_status":"Met","coding_standards_enforced_justification":"A style is preferred and enforced.facilitated by the build processes/tooling.\r\nhttps://www.zaproxy.org/docs/developer/","build_standard_variables_status":"N/A","build_standard_variables_justification":"Java builds","build_preserve_debug_status":"N/A","build_preserve_debug_justification":"Java builds","build_non_recursive_status":"N/A","build_non_recursive_justification":"There are no sub-directories for cross-dependencies","build_repeatable_status":"Met","build_repeatable_justification":"https://github.com/zaproxy/zaproxy","installation_standard_variables_status":"Met","installation_standard_variables_justification":"Users are able to specify a destination directory using the standard installers","installation_development_quick_status":"Met","installation_development_quick_justification":"The software is easily installable, both with the normal binary installer and packages that can be unzipped. Additionally it is easy to setup a build environment and run the software from source.","external_dependencies_status":"Met","external_dependencies_justification":"External dependencies are listed and maintained as part of the Gradle build (including tasks/plugins for identification of out-dated dependencies).\r\nhttps://github.com/zaproxy/zaproxy\r\n(Additionally the team is considering production of a SBOM for ZAP.)","dependency_monitoring_status":"Met","dependency_monitoring_justification":"The team does periodically check whether external dependencies require upgrade for security or any reason.\r\nhttps://github.com/zaproxy/zaproxy/pulls\r\nhttps://github.com/zaproxy/zap-extensions/pulls","updateable_reused_components_status":"Met","updateable_reused_components_justification":"External dependencies are listed and maintained as part of the Gradle build (including tasks/plugins for identification of out-dated dependencies).\r\nThe team does periodically check whether external dependencies require upgrade for security or any reason.\r\nhttps://github.com/zaproxy/zaproxy/pulls\r\nhttps://github.com/zaproxy/zap-extensions/pulls","interfaces_current_status":"Met","interfaces_current_justification":"As outlined above the project team does make significant efforts to ensure dependencies and functionality are kept up-to-date.","automated_integration_testing_status":"Met","automated_integration_testing_justification":"Tests are run as part of our CI builds (both for commits and PRs).\r\nhttps://github.com/zaproxy/zaproxy","regression_tests_added50_status":"Met","regression_tests_added50_justification":"The majority of new contributions include new or updated unit tests,","test_statement_coverage80_status":"Met","test_statement_coverage80_justification":"Due to the multi-platform nature of zap and it's storied history, this is very hard to reach. The majority of new contributions include new or updated unit tests.","test_policy_mandated_status":"Met","test_policy_mandated_justification":"https://www.zaproxy.org/docs/developer/dev-rules-and-guidelines/","implement_secure_design_status":"Met","implement_secure_design_justification":"ZAP's options all have safe defaults, it also implements a \"Mode\" which the user can leverage to further protect themselves and their targets. In some cases due to the simple nature of the project unsafe TLS/SSL ciphers may be allowed/used, etc.","input_validation_status":"Met","input_validation_justification":"The idea behind these tools is to get input from external source and use to offer a functionality. They can normally not be white nor blacklisted. It's data we use.","crypto_algorithm_agility_status":"Met","crypto_algorithm_agility_justification":"Where applicable the user is able to select their desired support for TLS protocol version etc.","crypto_credential_agility_status":"Met","crypto_credential_agility_justification":"Where applicable the end user can choose to use whatever type of credential they may need. However, ZAP itself does not require the use of any specific credential etc.","signed_releases_status":"?","signed_releases_justification":"This is a goal the team continues to strive toward. At this time it is not met. Doing this in a cross platform manner for a Java project is proving rather challenging.","version_tags_signed_status":"Met","version_tags_signed_justification":"https://github.com/zaproxy/zaproxy/releases/tag/v2.11.0","badge_percentage_2":74,"contributors_unassociated_status":"Met","contributors_unassociated_justification":"The core team is currently four unassociated members: https://www.zaproxy.org/docs/contribute/core-team/","copyright_per_file_status":"Met","copyright_per_file_justification":"All source files include a license header, including copyright year. Headers are applied as part of our standard processing (spotlessApply).","license_per_file_status":"Met","license_per_file_justification":"All source files include a license header, including copyright year. Headers are applied as part of our standard processing (spotlessApply).","small_tasks_status":"Met","small_tasks_justification":"Our issues tracker uses various labels including those good for new comers, GSoC ideas, projects, etc.\r\nhttps://github.com/zaproxy/zaproxy/issues","require_2FA_status":"Met","require_2FA_justification":"Core team members are required to use 2FA for GitHub.","secure_2FA_status":"Met","secure_2FA_justification":"The team does not use SMS based 2FA.","code_review_standards_status":"Met","code_review_standards_justification":"https://www.zaproxy.org/docs/developer/dev-rules-and-guidelines/\r\nhttps://github.com/zaproxy/zaproxy/blob/main/CONTRIBUTING.md","two_person_review_status":"Met","two_person_review_justification":"All PRs are reviewed by at least two Core Team members (other than the submitting member when changes originate within the team).","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"Met","security_review_justification":"ZAP is a security tool, it is regularly run against our web sites. There is a Bug Bounty program which covers ZAP itself and the primary web site.","assurance_case_status":"Met","assurance_case_justification":"https://www.zaproxy.org/faq/what-is-zaps-assurance-case/","achieve_passing_status":"Met","achieve_silver_status":"Unmet","tiered_percentage":198,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":"2016-08-10T07:03:00.000Z","first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":true,"gold_saved":true,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"passing","additional_rights":[16138,16154],"project_entry_attribution":"Please credit Simon Bennetts and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"},{"id":26,"user_id":27,"name":"TrouSerS","description":"A software stack that provides a programmatic API to the computer's Trusted Platform Module (TPM) as specified by the Trusted Computing Group (TCG).","homepage_url":"http://trousers.sourceforge.net","repo_url":"http://trousers.sourceforge.net","license":"CPL-1.0","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Unmet","description_good_status":"Met","interact_status":"Met","contribution_status":"Met","contribution_requirements_status":"Met","license_location_status":"Met","floss_license_status":"Met","floss_license_osi_status":"Met","documentation_basics_status":"Met","documentation_interface_status":"Met","repo_public_status":"Met","repo_track_status":"Met","repo_interim_status":"Met","repo_distributed_status":"Met","version_unique_status":"Met","version_semver_status":"Met","version_tags_status":"Met","release_notes_status":"Met","release_notes_vulns_status":"Met","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_process_status":"Met","report_responses_status":"Met","enhancement_responses_status":"Met","report_archive_status":"Met","vulnerability_report_process_status":"Met","vulnerability_report_private_status":"Met","vulnerability_report_response_status":"Met","build_status":"Met","build_common_tools_status":"Met","build_floss_tools_status":"Met","test_status":"Met","test_invocation_status":"Met","test_most_status":"Met","test_policy_status":"Met","tests_are_added_status":"Met","tests_documented_added_status":"Unmet","warnings_status":"Met","warnings_fixed_status":"Met","warnings_strict_status":"Met","know_secure_design_status":"Met","know_common_errors_status":"Met","crypto_published_status":"Met","crypto_call_status":"Met","crypto_floss_status":"Met","crypto_keylength_status":"Met","crypto_working_status":"Met","crypto_pfs_status":"Met","crypto_password_storage_status":"Met","crypto_random_status":"Met","delivery_mitm_status":"Met","delivery_unsigned_status":"Met","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_critical_fixed_status":"Met","static_analysis_status":"Met","static_analysis_justification":"Coverity","static_analysis_common_vulnerabilities_status":"Met","static_analysis_fixed_status":"Met","static_analysis_often_status":"Unmet","static_analysis_often_justification":"once per release","dynamic_analysis_status":"Met","dynamic_analysis_unsafe_status":"Met","dynamic_analysis_enable_assertions_status":"Met","dynamic_analysis_fixed_status":"Met","general_comments":"","created_at":"2015-10-29T21:13:39.923Z","updated_at":"2015-10-29T21:13:39.923Z","crypto_weaknesses_status":"Met","test_continuous_integration_status":"Unmet","cpe":"","discussion_status":"?","no_leaked_credentials_status":"Met","english_status":"Met","hardening_status":"?","crypto_used_network_status":"?","crypto_tls12_status":"?","crypto_certificate_verification_status":"?","crypto_verification_private_status":"?","hardened_site_status":"?","installation_common_status":"?","build_reproducible_status":"?","badge_percentage_0":85,"achieved_passing_at":null,"lost_passing_at":null,"last_reminder_at":"2026-07-05T23:01:15.744Z","disabled_reminders":false,"implementation_languages":"","lock_version":38,"badge_percentage_1":0,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":0,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Unmet","achieve_silver_status":"Unmet","tiered_percentage":85,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":null,"first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":false,"gold_saved":false,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"in_progress","additional_rights":[],"project_entry_attribution":"Please credit Charlemange and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0"},{"id":29,"user_id":24,"name":"Node.js","description":"Node.js® is a JavaScript runtime built on Chrome's V8 JavaScript engine","homepage_url":"https://nodejs.org","repo_url":"https://github.com/nodejs/node","license":"MIT","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","description_good_status":"Met","interact_status":"Met","interact_justification":"https://nodejs.org/en/get-involved/","contribution_status":"Met","contribution_justification":"https://github.com/nodejs/node/blob/master/CONTRIBUTING.md","contribution_requirements_status":"Met","contribution_requirements_justification":"https://github.com/nodejs/node/blob/master/CONTRIBUTING.md","license_location_status":"Met","license_location_justification":"https://github.com/nodejs/node/blob/master/LICENSE","floss_license_status":"Met","floss_license_justification":"The MIT license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The MIT license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"Met","documentation_basics_justification":"https://nodejs.org/en/docs/","documentation_interface_status":"Met","documentation_interface_justification":"https://nodejs.org/api/","repo_public_status":"Met","repo_track_status":"Met","repo_track_justification":"Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"Met","repo_distributed_status":"Met","repo_distributed_justification":"Repository on GitHub, which uses git. git is distributed.","version_unique_status":"Met","version_unique_justification":"strictly semver","version_semver_status":"Met","version_tags_status":"Met","version_tags_justification":"git tags","release_notes_status":"Met","release_notes_justification":"https://github.com/nodejs/node/blob/master/CHANGELOG.md","release_notes_vulns_status":"Met","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"https://github.com/nodejs/node/issues","report_process_status":"Met","report_process_justification":"https://github.com/nodejs/node/issues","report_responses_status":"Met","enhancement_responses_status":"Met","report_archive_status":"Met","report_archive_justification":"https://github.com/nodejs/node/issues","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"https://nodejs.org/en/security/","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"https://nodejs.org/en/security/#disclosure-policy","vulnerability_report_response_status":"Met","vulnerability_report_response_justification":"\"Your email will be acknowledged within 24 hours\"","build_status":"Met","build_justification":"https://github.com/nodejs/node#build","build_common_tools_status":"Met","build_common_tools_justification":"python, make or batch file, gcc or clang","build_floss_tools_status":"Met","build_floss_tools_justification":"python, make or batch file, gcc or clang","test_status":"Met","test_invocation_status":"Met","test_invocation_justification":"make or batch file, executed using python","test_most_status":"Met","test_policy_status":"Met","test_policy_justification":"https://github.com/nodejs/node/blob/main/doc/contributing/pull-requests.md#step-6-test","tests_are_added_status":"Met","tests_documented_added_status":"Met","warnings_status":"Met","warnings_justification":"Wall for compiling, c++ and JS linting as part of test suite","warnings_fixed_status":"Met","warnings_strict_status":"Met","know_secure_design_status":"Met","know_common_errors_status":"Met","crypto_published_status":"Met","crypto_published_justification":"All crypto uses openssl","crypto_call_status":"Met","crypto_call_justification":"All crypto uses openssl","crypto_floss_status":"Met","crypto_keylength_status":"Met","crypto_keylength_justification":"If someone wants to, they can use custom OpenSSL configurations, custom OpenSSL providers, or even custom dynamically linked OpenSSL builds to \"configure\" Node.js's crypto module","crypto_working_status":"Met","crypto_pfs_status":"Met","crypto_password_storage_status":"N/A","crypto_random_status":"Met","delivery_mitm_status":"Met","delivery_unsigned_status":"Met","delivery_unsigned_justification":"https://github.com/nodejs/node#verifying-binaries","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_fixed_60_days_justification":"For Node.js dependencies we have a repository https://github.com/nodejs/nodejs-dependency-vuln-assessments/issues containing all the public CVEs that weren't addressed in the Node.js scope and all of them are assessed regularly.","vulnerabilities_critical_fixed_status":"Met","static_analysis_status":"Met","static_analysis_justification":"https://scan.coverity.com/projects/node-js","static_analysis_common_vulnerabilities_status":"Met","static_analysis_common_vulnerabilities_justification":"https://github.com/nodejs/node/blob/main/doc/contributing/static-analysis.md","static_analysis_fixed_status":"Met","static_analysis_often_status":"Met","dynamic_analysis_status":"Met","dynamic_analysis_justification":"Infrastructure for running several different dynamic analysis tools is provided by the project. See: https://github.com/nodejs/node/tree/master/tools","dynamic_analysis_unsafe_status":"Met","dynamic_analysis_unsafe_justification":"valgrind for c++","dynamic_analysis_enable_assertions_status":"Unmet","dynamic_analysis_fixed_status":"Met","general_comments":"","created_at":"2015-11-02T10:16:28.649Z","updated_at":"2024-05-07T09:50:05.534Z","crypto_weaknesses_status":"Met","test_continuous_integration_status":"Met","test_continuous_integration_justification":"https://ci.nodejs.org/","cpe":"cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*","discussion_status":"Met","discussion_justification":"GitHub issue tracker and pull requests support discussion","no_leaked_credentials_status":"Met","english_status":"Met","hardening_status":"N/A","hardening_justification":"The the final user has the power to decide, see: Node.js thread model (https://github.com/nodejs/node/blob/main/SECURITY.md#the-nodejs-threat-model)","crypto_used_network_status":"N/A","crypto_used_network_justification":"The project does not produce software that supports network communications, the final user is responsible for that when using Node.js.","crypto_tls12_status":"Met","crypto_certificate_verification_status":"Met","crypto_verification_private_status":"Met","hardened_site_status":"Unmet","hardened_site_justification":"// One or more of the required security hardening headers is missing.","installation_common_status":"Met","installation_common_justification":"https://nodejs.org/en/download","build_reproducible_status":"Unmet","badge_percentage_0":100,"achieved_passing_at":"2016-02-12T01:57:00.000Z","lost_passing_at":null,"last_reminder_at":null,"disabled_reminders":false,"implementation_languages":"JavaScript, C++, Python (CII estimate)","lock_version":31,"badge_percentage_1":64,"dco_status":"Met","dco_justification":"https://github.com/nodejs/node/blob/main/CONTRIBUTING.md#developers-certificate-of-origin","governance_status":"Met","governance_justification":"https://github.com/nodejs/node/blob/main/GOVERNANCE.md","code_of_conduct_status":"Met","code_of_conduct_justification":"https://github.com/nodejs/node/blob/main/CODE_OF_CONDUCT.md","roles_responsibilities_status":"Met","roles_responsibilities_justification":"https://github.com/nodejs/node/blob/main/GOVERNANCE.md","access_continuity_status":"Met","access_continuity_justification":"https://github.com/nodejs/node/blob/main/GOVERNANCE.md","bus_factor_status":"Met","bus_factor_justification":"https://github.com/nodejs/node/blob/main/README.md#current-project-team-members","documentation_roadmap_status":"Met","documentation_roadmap_justification":"https://github.com/nodejs/node/blob/HEAD/doc/contributing/strategic-initiatives.md","documentation_architecture_status":"Met","documentation_architecture_justification":"https://github.com/nodejs/node/tree/main/doc/contributing","documentation_security_status":"Met","documentation_security_justification":"https://github.com/nodejs/node/blob/main/SECURITY.md and https://github.com/nodejs/node/blob/main/SECURITY.md#the-nodejs-threat-model","documentation_quick_start_status":"Met","documentation_quick_start_justification":"https://nodejs.dev/en/learn/","documentation_current_status":"Met","documentation_current_justification":"https://github.com/nodejs/node/blob/main/doc/contributing/api-documentation.md","documentation_achievements_status":"Met","documentation_achievements_justification":"https://github.com/nodejs/nodejs.org/issues/5432 and https://nodejs.org/en/about/security-reporting#openssf-best-practices","accessibility_best_practices_status":"Met","accessibility_best_practices_justification":"Tested with automatic tools, but there is no dedicated team for accessibility.","internationalization_status":"N/A","internationalization_justification":"The project does not produce software that generates text intended for end-users and doesn't sort human-readable text. The end user is responsible for that when using Node.js.","sites_password_security_status":"N/A","sites_password_security_justification":"The project does not store passwords for authentication of external users.","maintenance_or_update_status":"Met","maintenance_or_update_justification":"https://github.com/nodejs/release#release-schedule","vulnerability_report_credit_status":"Met","vulnerability_report_credit_justification":"https://hackerone.com/nodejs/hacktivity","vulnerability_response_process_status":"Met","vulnerability_response_process_justification":"https://github.com/nodejs/node/blob/main/SECURITY.md","coding_standards_status":"Met","coding_standards_justification":"https://github.com/nodejs/node/blob/main/doc/contributing/cpp-style-guide.md","coding_standards_enforced_status":"Met","coding_standards_enforced_justification":"The details can be found at https://github.com/nodejs/node/blob/main/Makefile","build_standard_variables_status":"Met","build_preserve_debug_status":"Met","build_non_recursive_status":"Met","build_repeatable_status":"Unmet","installation_standard_variables_status":"Met","installation_development_quick_status":"Met","installation_development_quick_justification":"https://github.com/nodejs/node/blob/main/doc/contributing/pull-requests.md#setting-up-your-local-environment","external_dependencies_status":"Met","external_dependencies_justification":"https://github.com/nodejs/node/blob/main/doc/contributing/maintaining/maintaining-dependencies.md","dependency_monitoring_status":"Met","updateable_reused_components_status":"Met","interfaces_current_status":"Met","automated_integration_testing_status":"Met","regression_tests_added50_status":"Met","test_statement_coverage80_status":"Met","test_statement_coverage80_justification":"https://app.codecov.io/gh/nodejs/node","test_policy_mandated_status":"Met","implement_secure_design_status":"Met","input_validation_status":"Met","crypto_algorithm_agility_status":"Met","crypto_credential_agility_status":"N/A","crypto_credential_agility_justification":"The project does not produce software that stores authentication credentials or private cryptographic keys but it does provide a crypto module that can be used for that purpose by the final user. The final user is responsible for the security of the credentials and keys.","signed_releases_status":"Met","signed_releases_justification":"https://github.com/nodejs/node/blob/main/doc/contributing/releases.md#3-a-publicly-listed-gpg-key","version_tags_signed_status":"Met","version_tags_signed_justification":"https://github.com/nodejs/node/blob/main/doc/contributing/releases.md#11-tag-and-sign-the-release-commit","badge_percentage_2":61,"contributors_unassociated_status":"Met","contributors_unassociated_justification":"https://github.com/nodejs/node/blob/main/GOVERNANCE.md","copyright_per_file_status":"Unmet","copyright_per_file_justification":"see: https://github.com/nodejs/security-wg/issues/1187","license_per_file_status":"Unmet","license_per_file_justification":"see: see: https://github.com/nodejs/security-wg/issues/1187","small_tasks_status":"Met","small_tasks_justification":"For example https://github.com/nodejs/node/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22","require_2FA_status":"Met","require_2FA_justification":"Node.js org has enabled 2FA for all the members, see: https://github.com/openjs-foundation/security-collab-space/issues/94#issuecomment-1874627417","secure_2FA_status":"Met","secure_2FA_justification":"We Use Github, so we follow the recommendations. Documentation: https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/about-two-factor-authentication","code_review_standards_status":"Met","code_review_standards_justification":"The process is documented: https://github.com/nodejs/node/blob/main/doc/contributing/pull-requests.md#reviewing-pull-requests","two_person_review_status":"Met","two_person_review_justification":"The process is documented: https://github.com/nodejs/node/blob/main/doc/contributing/pull-requests.md#reviewing-pull-requests and we use additional tools like the OSSF Scorecard to monitor it","test_statement_coverage90_status":"Met","test_statement_coverage90_justification":"Report available in https://app.codecov.io/gh/nodejs/node","test_branch_coverage80_status":"Met","test_branch_coverage80_justification":"Report available in https://app.codecov.io/gh/nodejs/node","security_review_status":"Unmet","assurance_case_status":"Met","assurance_case_justification":"https://github.com/nodejs/node/blob/main/SECURITY.md","achieve_passing_status":"Met","achieve_silver_status":"Unmet","tiered_percentage":164,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":"2016-02-12T01:57:00.000Z","first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":true,"gold_saved":true,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"passing","additional_rights":[26967],"project_entry_attribution":"Please credit Rod Vagg and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"},{"id":31,"user_id":29,"name":"OSSEC","description":"OSSEC is an Open Source Host-based Intrusion Detection System that performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.  It runs on most operating systems, including Linux, MacOS, Solaris, HP-UX, AIX and Windows. ","homepage_url":"http://ossec.github.io","repo_url":"https://github.com/ossec/ossec-hids","license":"GPL-2.0","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","sites_https_justification":"https://ossec.github.io supports TLS v1.2","description_good_status":"Met","description_good_justification":"https://ossec.github.io/about.html","interact_status":"Met","interact_justification":"https://ossec.github.io/about.html#community-support","contribution_status":"Met","contribution_justification":"Yes, the OSSEC project accepts pull requests. Further information is available here https://ossec.github.io/about.html#community-support and https://github.com/ossec/ossec-hids","contribution_requirements_status":"Met","contribution_requirements_justification":"http://ossec.github.io/docs/development/oRFC/index.html ","license_location_status":"Met","license_location_justification":"https://github.com/ossec/ossec-hids/blob/master/LICENSE","floss_license_status":"Met","floss_license_justification":"https://ossec.github.io/about.html#ossec-is-free and in the root directory of the archive/github as LICENSE (https://github.com/ossec/ossec-hids/blob/master/LICENSE)","floss_license_osi_status":"Met","documentation_basics_status":"Met","documentation_basics_justification":"https://ossec.github.io/docs/\r\n\r\nadditionally the Documentation is covered under SCM at: https://github.com/ossec/ossec-docs","documentation_interface_status":"Met","documentation_interface_justification":"Provides plenty of documentation on how to install, implement, and provides code based examples:\r\nhttp://ossec.github.io/docs/examples/output/index.html","repo_public_status":"Met","repo_public_justification":"Yes, the project is hosted on a publically accessible github: https://github.com/ossec/ossec-hids/","repo_track_status":"Met","repo_track_justification":"Changes are tracked in github at: https://github.com/ossec/ossec-hids/ and https://github.com/ossec/ossec-hids/commits/master","repo_interim_status":"Met","repo_interim_justification":"Yes the project is branched per release (ex: https://github.com/ossec/ossec-hids/commits/v2.8.3), as well as future milestone release(s) ex: (https://gthub.com/ossec/ossec-hids/commits/2_9_b) as well as a common master branch: https://github.com/ossec/ossec-hids/commits/master","repo_distributed_status":"Met","repo_distributed_justification":"The project uses git, https://github.com/ossec/ossec-hids/","version_unique_status":"Met","version_unique_justification":"Yes, the project uses SemVer format. Example: https://github.com/ossec/ossec-hids/releases","version_semver_status":"Met","version_tags_status":"Met","version_tags_justification":"Git tags are used for each release, and proposed release: Ex: https://github.com/ossec/ossec-hids/commits/v2.8.3, other tags are used for integration with external parties like Coverity, etc","release_notes_status":"Met","release_notes_justification":"The central changelog is maintained at: https://ossec.github.io/docs/whatsnew/index.html, additionally each release includes a changelog, example: https://github.com/ossec/ossec-hids/releases/tag/2.8.2","release_notes_vulns_status":"Met","release_notes_vulns_justification":"Yes, example: https://github.com/ossec/ossec-hids/releases/tag/2.8.2 (resolving CVE-2015-3222)","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"Bugs are tracked as individual issues at: https://github.com/ossec/ossec-hids/issues ","report_process_status":"Met","report_process_justification":"Yes, a public bug tracker is available at: https://github.com/ossec/ossec-hids/issues ","report_responses_status":"Met","report_responses_justification":"Bugs are accepted or rejected at: https://github.com/ossec/ossec-hids/issues, Core team members are notified of a bug report immediately. Standard response for accept/reject is within 24 hours","enhancement_responses_status":"Met","enhancement_responses_justification":"Feature requests/Enhancements are tracked at https://github.com/ossec/ossec-hids/issues, Core team members are notified immediately. Standard response for accept/reject is within 24 hours","report_archive_status":"Met","report_archive_justification":"Public access to the Issue tracker is available at https://github.com/ossec/ossec-hids/issues","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"Same as the bug reporting process, can be done through GitHub, but documentation also specifies that security issues can be sent through to an email:\r\nhttps://github.com/ossec/ossec-hids/blob/master/BUGS","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"Private security reports can also be sent via email in the same way:\r\nhttps://github.com/ossec/ossec-hids/blob/master/BUGS","vulnerability_report_response_status":"Met","vulnerability_report_response_justification":"Met, our response time for the last CVE submitted (CVE-2015-3222) was resolved within 24 hours. ","build_status":"Met","build_justification":"https://ossec.github.io/docs/manual/installation/index.html and\r\nhttps://ossec.github.io/docs/development/build/index.html","build_common_tools_status":"Met","build_common_tools_justification":"https://ossec.github.io/docs/development/build/index.html","build_floss_tools_status":"Met","build_floss_tools_justification":"https://ossec.github.io/docs/development/build/index.html\r\n\r\nOSSEC uses gcc, gnu make, cmake, and other open source tools to build.","test_status":"Met","test_justification":"Our rule test suite: https://ossec.github.io/docs/development/build/test-rules.html\r\n\r\nAutomated build bot repository (for integration with services like travisci, etc):\r\n\r\nhttps://github.com/ossec/ossec-buildbot\r\n\r\nVagrant test suite:\r\n\r\nhttps://github.com/ossec/ossec-vagrant","test_invocation_status":"Met","test_invocation_justification":"Test suite requires python, ossec, and the build tools to compile ossec:\r\nhttps://ossec.github.io/docs/development/build/test-rules.html#requirements","test_most_status":"Met","test_most_justification":"Each test suite (rules, buildbot, vagrant) covers different build \u0026 test suites, from regression testing (in the case of rules) to automatic building via buildbot \u0026 travis integration. Any branch can be applied in this context. Automatic testing is integrated in github for the stable and development branches now","test_policy_status":"Met","test_policy_justification":"All pull requests are automatically tested at the time they are committed via:\r\nhttps://travis-ci.org/ossec\r\n\r\n","tests_are_added_status":"Met","tests_are_added_justification":"Automatic build testing history is tracked at:\r\nhttps://travis-ci.org/ossec/ossec-hids\r\n\r\nFailures are automatically reported back into the pull request at github.com","tests_documented_added_status":"Met","tests_documented_added_justification":"All testing for commits, new or otherwise, runs through https://travis-ci.org/ossec/ossec-hids. Internal testing for new rule and decoders is maintained at: https://github.com/ossec/ossec-hids/tree/master/contrib/logtesting","warnings_status":"Met","warnings_justification":"Code is currently built with FORTIFY_SOURCE on distros that support this functionality. Binary packaging also includes -fPIE -pie -Wl,-z,relro","warnings_fixed_status":"Met","warnings_fixed_justification":"All warnings have been addressed either as a fixed issue or in the code itself.\r\nhttps://github.com/ossec/ossec-hids/search?q=warnings\u0026type=Issues\u0026utf8=%E2%9C%93","warnings_strict_status":"Met","warnings_strict_justification":"Project proves to be strict with warnings such that all warnings raised as an issue have been addressed, fixed, and the issue has been closed.  In instances where warnings are triggered but they are trivial, they are flagged in the code.  But, it is also noted in their repo that there are a number of instances where fixing warnings is too time consuming for little purpose, so they note that they assure the code works despite the warnings.\r\nhttps://github.com/ossec/ossec-hids/blob/a7ca63d6d074f2f6bdb49f4bc79a054c31dcafc7/src/external/zlib-1.2.8/FAQ","know_secure_design_status":"Met","know_secure_design_justification":"\"This product includes cryptographic software written by Eric Young (eay@cryptsoft.com)\"","know_common_errors_status":"Met","know_common_errors_justification":"\"This product includes cryptographic software written by Eric Young (eay@cryptsoft.com)\"","crypto_published_status":"Met","crypto_published_justification":"OpenSSL","crypto_call_status":"Met","crypto_call_justification":"OpenSSL","crypto_floss_status":"Met","crypto_keylength_status":"N/A","crypto_working_status":"Unmet","crypto_working_justification":"Currently the project relies on MD5 \u0026 SHA1 for the File Integrity Monitoring system. The project is currently in the process of updating this to SHA256.","crypto_pfs_status":"N/A","crypto_password_storage_status":"N/A","crypto_random_status":"N/A","delivery_mitm_status":"Met","delivery_mitm_justification":"Commits and release tags are signed before release. These keys are digitally signed by 3rd parties, and are downloaded over HTTPS. ","delivery_unsigned_status":"Met","delivery_unsigned_justification":"We only rely on releases digitally signed with the release maintainers GPG keys. These keys are both signed by 3rd parties, and only available via either known public PGP serves (MIT, bitkey) or via https (ex: https://www.atomicorp.com/RPM-GPG-KEY.atomicorp.txt) ","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_fixed_60_days_justification":"No unpatched high severity vulnerabilities.","vulnerabilities_critical_fixed_status":"Met","vulnerabilities_critical_fixed_justification":"Most vulnerabilities reported have been addressed and fixed:\r\nhttps://github.com/ossec/ossec-hids/search?q=vulnerability\u0026type=Issues\u0026utf8=%E2%9C%93","static_analysis_status":"Met","static_analysis_justification":"Uses coverity:\r\nhttps://scan.coverity.com/projects/ossec-ossec-hids","static_analysis_common_vulnerabilities_status":"Met","static_analysis_fixed_status":"Met","static_analysis_fixed_justification":"Vulnerabilities are addressed and fixed.","static_analysis_often_status":"Unmet","static_analysis_often_justification":"Static source code analysis is performed often (last check was 7 days ago), but not daily or on every commit.  ","dynamic_analysis_status":"Unmet","dynamic_analysis_justification":"The project currently uses Coverity scans at: https://scan.coverity.com/projects/1847","dynamic_analysis_unsafe_status":"Unmet","dynamic_analysis_unsafe_justification":"We currently test the software with Coverity on an scheduled basis, and spot check the software with valgrind. However we do not feel that this is good enough to warrant a \"Met\" categorization. We intend to build static analysis in at the commit level. ","dynamic_analysis_enable_assertions_status":"Unmet","dynamic_analysis_enable_assertions_justification":"This is currently planned for the next round of improvements in our travis-ci integration","dynamic_analysis_fixed_status":"Met","general_comments":"","created_at":"2015-11-05T17:49:54.985Z","updated_at":"2016-08-21T20:38:19.981Z","crypto_weaknesses_status":"Unmet","crypto_weaknesses_justification":"SHA-1 and MD5 are used","test_continuous_integration_status":"Met","test_continuous_integration_justification":"Automatic build testing is integrated with github \u0026 travis at:\r\nhttps://travis-ci.org/ossec","cpe":"cpe:/a:ossec","discussion_status":"Met","discussion_justification":"GitHub issue tracker and pull requests support discussion","no_leaked_credentials_status":"Met","english_status":"Met","english_justification":"Bug reports are accepted at: https://github.com/ossec/ossec-hids/issues, it is accepted in English and supports comment threading.\r\n\r\nEnglish Documentation is provided at: https://ossec.github.io/docs/ \r\n\r\nadditionally the Documentation is covered under SCM at: https://github.com/ossec/ossec-docs","hardening_status":"Met","hardening_justification":"All official binary packages are built with hardening flags (FORTIFY, etc), relro, and PIE settings. Source builds include references to these flags as well (compilerpermitting)","crypto_used_network_status":"Unmet","crypto_used_network_justification":"As this project by its nature is designed to act as a syslog server replacement, as the server component we are at the mercy of whatever the client submitting traffic uses. However the core OSSEC project uses only encrypted protocols between OSSEC agent and server installations. ","crypto_tls12_status":"N/A","crypto_certificate_verification_status":"N/A","crypto_verification_private_status":"N/A","hardened_site_status":"Met","hardened_site_justification":"The project source code is stored on github, further, release tags and archives are digitally signed with the release maintainer GPG keys.","installation_common_status":"Met","installation_common_justification":"This is currently implemented in our binary RPM and DEB packaging. These packages can be removed through standard OS tools. Source installations are self contained to the /var/ossec directory, and can be removed easily by removing this directory. However for configuration management we always recommend using our distributed binary packages.","build_reproducible_status":"Met","build_reproducible_justification":"Reproducible building is available  our published RPM and DEB spec files. These are included in our git repository","badge_percentage_0":99,"achieved_passing_at":null,"lost_passing_at":null,"last_reminder_at":"2026-05-01T23:00:50.788Z","disabled_reminders":false,"implementation_languages":"C, Shell, Perl (CII estimate)","lock_version":44,"badge_percentage_1":18,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":22,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Unmet","achieve_silver_status":"Unmet","tiered_percentage":99,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":null,"first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":true,"gold_saved":true,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"in_progress","additional_rights":[],"project_entry_attribution":"Please credit Scott R. Shinn and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0"},{"id":33,"user_id":23,"name":"Ruby on Rails","description":"Ruby on Rails is an open-source web framework that’s optimized for programmer happiness and sustainable productivity. It favors convention over configuration.","homepage_url":"http://rubyonrails.org","repo_url":"https://github.com/rails/rails","license":"MIT","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Unmet","sites_https_justification":"// Given an http: URL.","description_good_status":"Met","description_good_justification":"http://rubyonrails.org/","interact_status":"Met","interact_justification":"http://edgeguides.rubyonrails.org/contributing_to_ruby_on_rails.html","contribution_status":"Met","contribution_justification":"http://edgeguides.rubyonrails.org/contributing_to_ruby_on_rails.html","contribution_requirements_status":"Met","contribution_requirements_justification":"http://edgeguides.rubyonrails.org/contributing_to_ruby_on_rails.html#write-your-code","license_location_status":"Met","license_location_justification":"https://github.com/rails/rails/blob/master/activerecord/MIT-LICENSE and the same in other sub-projects.","floss_license_status":"Met","floss_license_justification":"https://github.com/rails/rails#license The MIT license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The MIT license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"Met","documentation_basics_justification":"http://guides.rubyonrails.org/","documentation_interface_status":"Met","documentation_interface_justification":"http://api.rubyonrails.org/","repo_public_status":"Met","repo_public_justification":"https://github.com/rails/rails","repo_track_status":"Met","repo_track_justification":"Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"Met","repo_distributed_status":"Met","repo_distributed_justification":"Repository on GitHub, which uses git. git is distributed.","version_unique_status":"Met","version_semver_status":"Met","version_tags_status":"Met","version_tags_justification":"https://github.com/rails/rails/releases","release_notes_status":"Met","release_notes_justification":"http://weblog.rubyonrails.org/releases/","release_notes_vulns_status":"Met","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_process_status":"Met","report_process_justification":"https://github.com/rails/rails/issues","report_responses_status":"Met","enhancement_responses_status":"Met","report_archive_status":"Met","report_archive_justification":"https://github.com/rails/rails/issues","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"http://rubyonrails.org/security/","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"http://rubyonrails.org/security/","vulnerability_report_response_status":"Met","build_status":"Met","build_justification":"https://github.com/rails/rails/blob/master/RELEASING_RAILS.md","build_common_tools_status":"Met","build_floss_tools_status":"Met","test_status":"Met","test_justification":"http://guides.rubyonrails.org/contributing_to_ruby_on_rails.html#running-tests","test_invocation_status":"Met","test_invocation_justification":"http://guides.rubyonrails.org/contributing_to_ruby_on_rails.html#running-tests","test_most_status":"Met","test_policy_status":"Met","test_policy_justification":"http://guides.rubyonrails.org/contributing_to_ruby_on_rails.html#write-your-code","tests_are_added_status":"Met","tests_documented_added_status":"Met","tests_documented_added_justification":"http://guides.rubyonrails.org/contributing_to_ruby_on_rails.html#write-your-code","warnings_status":"Met","warnings_justification":"As explained in the [Contributing to Ruby on Rails (warning section)](http://edgeguides.rubyonrails.org/contributing_to_ruby_on_rails.html#warnings): \"The test suite runs with warnings enabled. Ideally, Ruby on Rails should issue no warnings, but there may be a few, as well as some from third-party libraries. Please ignore (or fix!) them, if any, and submit patches that do not issue new warnings. If you are sure about what you are doing and would like to have a more clear output, there's a way to override the flag:\r\n$ RUBYOPT=-W0 bundle exec rake test\".  In short, Rails *does* run with Ruby compiler warnings, and patches are to be submitted in a way that \"do not issue new warnings\".","warnings_fixed_status":"Met","warnings_fixed_justification":"See [Contributing to Ruby on Rails (warning section)](http://edgeguides.rubyonrails.org/contributing_to_ruby_on_rails.html#warnings).","warnings_strict_status":"Unmet","know_secure_design_status":"Met","know_common_errors_status":"Met","crypto_published_status":"Met","crypto_call_status":"Met","crypto_floss_status":"Met","crypto_keylength_status":"N/A","crypto_working_status":"Met","crypto_working_justification":"http://api.rubyonrails.org/classes/ActiveSupport/MessageEncryptor.html","crypto_pfs_status":"N/A","crypto_password_storage_status":"N/A","crypto_random_status":"Met","delivery_mitm_status":"Met","delivery_mitm_justification":"https://rubygems.org/gems/rails/","delivery_unsigned_status":"Met","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_critical_fixed_status":"Met","static_analysis_status":"?","static_analysis_common_vulnerabilities_status":"Unmet","static_analysis_fixed_status":"?","static_analysis_often_status":"Unmet","dynamic_analysis_status":"Unmet","dynamic_analysis_unsafe_status":"N/A","dynamic_analysis_enable_assertions_status":"Unmet","dynamic_analysis_fixed_status":"Unmet","general_comments":"","created_at":"2015-11-05T21:12:14.273Z","updated_at":"2020-10-15T21:53:50.843Z","crypto_weaknesses_status":"Met","test_continuous_integration_status":"Met","test_continuous_integration_justification":"https://travis-ci.org/rails/rails","cpe":"cpe:/a:rubyonrails","discussion_status":"Met","discussion_justification":"GitHub issue tracker and pull requests support discussion","no_leaked_credentials_status":"Met","english_status":"Met","hardening_status":"?","crypto_used_network_status":"?","crypto_tls12_status":"?","crypto_certificate_verification_status":"?","crypto_verification_private_status":"?","hardened_site_status":"Unmet","hardened_site_justification":"// X-Content-Type-Options was not set to \"nosniff\".","installation_common_status":"?","build_reproducible_status":"?","badge_percentage_0":94,"achieved_passing_at":null,"lost_passing_at":null,"last_reminder_at":"2025-04-09T23:01:22.932Z","disabled_reminders":false,"implementation_languages":"Ruby, JavaScript, CoffeeScript (CII estimate)","lock_version":40,"badge_percentage_1":4,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":13,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Unmet","achieve_silver_status":"Unmet","tiered_percentage":94,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":null,"first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":false,"gold_saved":true,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"in_progress","additional_rights":[],"project_entry_attribution":"Please credit Dan Kohn and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"},{"id":34,"user_id":30,"name":"Linux Kernel","description":"The Linux kernel.","homepage_url":"https://www.kernel.org","repo_url":"https://git.kernel.org","license":"GPL-2.0","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","description_good_status":"Met","description_good_justification":"https://www.kernel.org/linux.html","interact_status":"Met","interact_justification":"https://bugzilla.kernel.org/","contribution_status":"Met","contribution_justification":"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/HOWTO","contribution_requirements_status":"Met","contribution_requirements_justification":"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/SubmittingPatches","license_location_status":"Met","license_location_justification":"The license (GPL-2.0) is in the file COPYING, see \u003chttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/COPYING\u003e.","floss_license_status":"Met","floss_license_justification":"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/COPYING The GPL-2.0 license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The GPL-2.0 license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"Met","documentation_basics_justification":"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/","documentation_interface_status":"Met","documentation_interface_justification":"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/ABI/","repo_public_status":"Met","repo_public_justification":"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git","repo_track_status":"Met","repo_track_justification":"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git","repo_interim_status":"Met","repo_interim_justification":"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git","repo_distributed_status":"Met","repo_distributed_justification":"https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git","version_unique_status":"Met","version_semver_status":"Unmet","version_semver_justification":"The Linux kernel does not make API changes that affect userspace, so there is no need to have denote api compatibility, it is always stable.","version_tags_status":"Met","release_notes_status":"Met","release_notes_justification":"http://kernelnewbies.org/LinuxChanges","release_notes_vulns_status":"Met","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"https://bugzilla.kernel.org","report_process_status":"Met","report_process_justification":"See https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/REPORTING-BUGS","report_responses_status":"Met","enhancement_responses_status":"Unmet","enhancement_responses_justification":"It is up to contributors to submit enhancement requests, the Linux kernel developers almost never accept \"enhancement requests\" on their own.","report_archive_status":"Met","report_archive_justification":"Reports and responses are handled as described in \u003chttps://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/REPORTING-BUGS\u003e.  Many reports on subsystems are handled via subsystem mailing lists, see \u003chttp://vger.kernel.org/vger-lists.html\u003e.  Archives of the overall linux-kernel mailing list are available via \u003chttp://vger.kernel.org/vger-lists.html#linux-kernel\u003e. The kernel bug tracker is also used (and is searchable); it is accessible at \u003chttps://bugzilla.kernel.org/\u003e.","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"The vulnerability reporting process is described in https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/REPORTING-BUGS and https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/SecurityBugs","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"See https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/Documentation/SecurityBugs","vulnerability_report_response_status":"Met","build_status":"Met","build_common_tools_status":"Met","build_floss_tools_status":"Met","test_status":"Met","test_justification":"An example is the Linux Test Project http://linux-test-project.github.io/","test_invocation_status":"Met","test_invocation_justification":"https://www.kernel.org/doc/html/latest/process/development-process.html describes how 'make tests' works.","test_most_status":"Unmet","test_most_justification":"Kernel tests test individual feature functionality, not code branches, and is generally for only \"new\" features, not older POSIX-like functionality.","test_policy_status":"Met","tests_are_added_status":"Met","tests_documented_added_status":"Met","tests_documented_added_justification":"Not all new features are able to have automated tests added for them.  But, for new syscalls, we do strongly recommend that new tests be added to the automated test suite to show that testing has happened, and to allow for regressions to be found over time.","warnings_status":"Met","warnings_justification":"The kernel build process enables a lot of warning flags, and it also provides the tool 'sparse' to check for many other coding problems.  And a full test suite of coccineele scripts is integrated into the kernel source tree itself.","warnings_fixed_status":"Met","warnings_strict_status":"Met","warnings_strict_justification":"Where ever practical, all warnings are fixed.","know_secure_design_status":"Met","know_common_errors_status":"Met","crypto_published_status":"Met","crypto_call_status":"N/A","crypto_floss_status":"Met","crypto_keylength_status":"Met","crypto_working_status":"Met","crypto_pfs_status":"N/A","crypto_password_storage_status":"N/A","crypto_random_status":"Met","delivery_mitm_status":"Met","delivery_unsigned_status":"Met","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_critical_fixed_status":"Met","static_analysis_status":"Met","static_analysis_justification":"Coverity and sparse and smatch and many other static code analysis tools are run on the kernel all the time.","static_analysis_common_vulnerabilities_status":"Met","static_analysis_common_vulnerabilities_justification":"We use coverity and sparse and smatch and others for this.","static_analysis_fixed_status":"Met","static_analysis_often_status":"Met","dynamic_analysis_status":"Met","dynamic_analysis_justification":"https://01.org/lkp/documentation/0-day-test-service runs lots of these tools on all trees before release.","dynamic_analysis_unsafe_status":"Met","dynamic_analysis_unsafe_justification":"We use coverity and sparse and smatch and others for this","dynamic_analysis_enable_assertions_status":"Met","dynamic_analysis_enable_assertions_justification":"Look at all of the wonderful BUG_ON() calls in the kernel (hint, you really don't want those to ever trigger, but they are there...)","dynamic_analysis_fixed_status":"Met","general_comments":"","created_at":"2015-11-10T02:54:22.943Z","updated_at":"2026-06-27T07:57:08.250Z","crypto_weaknesses_status":"Met","crypto_weaknesses_justification":"https://www.kernel.org/doc/html/latest/crypto/architecture.html","test_continuous_integration_status":"Met","test_continuous_integration_justification":"https://01.org/lkp/documentation/0-day-test-service\r\nThe 0-day bot does testing of every commit before it is merged into the main repository.","cpe":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","discussion_status":"Met","no_leaked_credentials_status":"Met","english_status":"Met","hardening_status":"Met","hardening_justification":"The Linux kernel self protection project develops hardening improvements for the Linux kernel; many of them have already been accepted into the Linux kernel mainline: http://kernsec.org/wiki/index.php/Kernel_Self_Protection_Project\r\nThere are a number of hardening mechanisms in the Linux kernel, such as Linux kernel stack protection.\r\n","crypto_used_network_status":"N/A","crypto_used_network_justification":"The kernel implements network packets in general; applications running on top request or perform network communication.  The kernel does implement IPSEC, which is used if requested.  Otherwise, the user specifically requests or configures whatever network protocol is used.","crypto_tls12_status":"Met","crypto_tls12_justification":"The kernel properly implements TLS if you are so crazy as to wish to use it from within kernelspace.","crypto_certificate_verification_status":"Met","crypto_certificate_verification_justification":"The kernel properly implements TLS if you are so crazy as to wish to use it from within kernelspace.","crypto_verification_private_status":"Met","crypto_verification_private_justification":"The kernel properly implements TLS if you are so crazy as to wish to use it from within kernelspace.","hardened_site_status":"Met","hardened_site_justification":"https://kernel.org // One or more of the required security hardening headers is missing.","installation_common_status":"Met","installation_common_justification":"Many third parties provide packages (e.g., .deb for apt-get, .rpm).  It's also provided as an xz-compressed tarball.  Since this is a kernel, installation is in general different than application software.","build_reproducible_status":"Met","build_reproducible_justification":"https://www.kernel.org/doc/html/latest/","badge_percentage_0":100,"achieved_passing_at":"2018-06-14T16:10:57.381Z","lost_passing_at":"2018-06-14T15:39:52.003Z","last_reminder_at":null,"disabled_reminders":false,"implementation_languages":"C, Assembly, Rust","lock_version":43,"badge_percentage_1":100,"dco_status":"Met","dco_justification":"https://www.kernel.org/doc/html/latest/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin\r\nWe created the DCO for the kernel project :)","governance_status":"Met","governance_justification":"https://www.kernel.org/doc/html/latest/process/development-process.html\r\n","code_of_conduct_status":"Met","code_of_conduct_justification":"https://www.kernel.org/doc/html/latest/process/code-of-conflict.html","roles_responsibilities_status":"Met","roles_responsibilities_justification":"https://www.kernel.org/doc/html/latest/process/development-process.html\r\n","access_continuity_status":"Met","access_continuity_justification":"https://www.kernel.org/doc/html/latest/process/development-process.html\r\n","bus_factor_status":"Met","bus_factor_justification":"https://www.kernel.org/doc/html/latest/process/development-process.html\r\n","documentation_roadmap_status":"Met","documentation_roadmap_justification":"There is never a roadmap for the kernel, this type of thing is crazy for a project to try to determine.\r\nIf you want to see what is coming, look at https://git.kernel.org/\r\n","documentation_architecture_status":"Met","documentation_architecture_justification":"https://www.kernel.org/doc/html/latest/process/development-process.html\r\n","documentation_security_status":"Met","documentation_security_justification":"https://www.kernel.org/doc/html/latest/admin-guide/security-bugs.html","documentation_quick_start_status":"N/A","documentation_quick_start_justification":"A kernel is not a \"quick start\" type of thing.  That being said, https://kernelnewbies.org does provide a lot of documentation for people getting involved in development.","documentation_current_status":"Met","documentation_current_justification":"https://www.kernel.org/doc/html/latest/","documentation_achievements_status":"Met","documentation_achievements_justification":"https://www.kernel.org","accessibility_best_practices_status":"Met","accessibility_best_practices_justification":"https://www.kernel.org/","internationalization_status":"N/A","internationalization_justification":"A kernel does not need to have any locale at all.","sites_password_security_status":"N/A","sites_password_security_justification":"No passwords are stored.","maintenance_or_update_status":"Met","maintenance_or_update_justification":"https://www.kernel.org/","vulnerability_report_credit_status":"Met","vulnerability_report_credit_justification":"https://www.kernel.org/ has full changelog history of all commits, see the \"Reported-by:\" tags for full attributions.","vulnerability_response_process_status":"Met","vulnerability_response_process_justification":"https://www.kernel.org/doc/html/latest/admin-guide/security-bugs.html","coding_standards_status":"Met","coding_standards_justification":"https://www.kernel.org/doc/html/latest/process/coding-style.html","coding_standards_enforced_status":"Met","coding_standards_enforced_justification":"scripts/checkpatch.pl checks and enforces coding style rules.","build_standard_variables_status":"Met","build_standard_variables_justification":"All build environment variables are properly handled.","build_preserve_debug_status":"Met","build_preserve_debug_justification":"Configuration options allow for all debugging symbols to be retained in the built objects.","build_non_recursive_status":"Met","build_non_recursive_justification":"No recursion in the build system when there are cross-dependencies in the subdirectories.","build_repeatable_status":"Met","build_repeatable_justification":"The kernel meets the reproducible build requirements.","installation_standard_variables_status":"Met","installation_standard_variables_justification":"The kernel install process is standard on all distros as there is a distro-specific include script which always will work properly.","installation_development_quick_status":"Met","installation_development_quick_justification":"All distros usually have a 'kernel-developer' meta-package option to automatically install needed dependancies to build the project.","external_dependencies_status":"N/A","external_dependencies_justification":"The kernel has no external dependencies.","dependency_monitoring_status":"N/A","dependency_monitoring_justification":"The kernel has no external dependencies.","updateable_reused_components_status":"N/A","updateable_reused_components_justification":"The kernel has no external dependencies.","interfaces_current_status":"N/A","interfaces_current_justification":"The kernel has no external dependencies.","automated_integration_testing_status":"Met","automated_integration_testing_justification":"The 0-day bot runs on each commit in almost all maintainers trees before they are merged into Linus's tree.","regression_tests_added50_status":"N/A","regression_tests_added50_justification":"It is impossible to create automated regression tests for even a small percentage of the bugs found in the kernel.  But, people are actively working on this, and we do have a very large test suite that includes checks for almost all major CVEs that can be tested for.","test_statement_coverage80_status":"N/A","test_statement_coverage80_justification":"Code coverage is a horrible metric.  See above for the discussion about our automated regression tests.","test_policy_mandated_status":"Met","test_policy_mandated_justification":"Not all kernel functionality can be tested with an automated test suite.  That being said, we do have a huge test suite for almost all major functionality that is run all the time on all maintainer's branches to ensure no regressions happen.","implement_secure_design_status":"Met","implement_secure_design_justification":"The kernel implements \"known secure design\" principles.","input_validation_status":"Met","input_validation_justification":"\"All input is evil\" is the mantra the kernel attempts to follow.  We have automated testing for following userspace data into the kernel and when it is validated properly.","crypto_algorithm_agility_status":"Met","crypto_algorithm_agility_justification":"https://www.kernel.org/doc/html/latest/crypto/architecture.html","crypto_credential_agility_status":"Met","crypto_credential_agility_justification":"https://www.kernel.org/doc/html/latest/crypto/architecture.html","signed_releases_status":"Met","signed_releases_justification":"https://www.kernel.org/category/signatures.html","version_tags_signed_status":"Met","version_tags_signed_justification":"All tags for kernel releases are properly signed.","badge_percentage_2":100,"contributors_unassociated_status":"Met","contributors_unassociated_justification":"https://www.kernel.org/","copyright_per_file_status":"Met","copyright_per_file_justification":"https://www.kernel.org/doc/html/latest/process/license-rules.html","license_per_file_status":"Met","license_per_file_justification":"https://www.kernel.org/doc/html/latest/process/license-rules.html","small_tasks_status":"Met","small_tasks_justification":"http://kernelnewbies.org/","require_2FA_status":"Met","require_2FA_justification":"https://www.kernel.org/category/signatures.html","secure_2FA_status":"Met","secure_2FA_justification":"https://www.kernel.org/category/signatures.html","code_review_standards_status":"Met","code_review_standards_justification":"https://www.kernel.org/doc/html/latest/process/development-process.html","two_person_review_status":"Met","two_person_review_justification":"https://www.kernel.org/doc/html/latest/process/development-process.html","test_statement_coverage90_status":"N/A","test_statement_coverage90_justification":"There is no such tool that can provide this.\r\n\r\nAnd code coverage is not an indication of code quality :)","test_branch_coverage80_status":"N/A","test_branch_coverage80_justification":"No such tool can provide this.","security_review_status":"Met","security_review_justification":"Lots of people audit the kernel all the time for these types of issues.","assurance_case_status":"Met","assurance_case_justification":"The kernel's security requirements are constantly tested and probed by everyone in the world.  When problems are found, they are resolved as quickly as possible as described in our security bugs reporting documentation: https://www.kernel.org/doc/html/latest/admin-guide/security-bugs.html","achieve_passing_status":"Met","achieve_silver_status":"Met","tiered_percentage":300,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":"2020-06-10T07:14:42.905Z","lost_gold_at":null,"first_achieved_passing_at":"2018-06-14T16:10:57.381Z","first_achieved_silver_at":null,"first_achieved_gold_at":"2020-06-10T07:14:42.905Z","maintained_status":"Met","OSPS-AC-01.01_status":"Met","OSPS-AC-02.01_status":"Met","OSPS-AC-03.01_status":"N/A","OSPS-AC-03.01_justification":"No direct commits are allowed.","OSPS-AC-03.02_status":"N/A","OSPS-AC-03.02_justification":"No deletion of branches are allowed.","OSPS-BR-01.01_status":"N/A","OSPS-BR-01.01_justification":"We have no CI/CD pipeline built in.","OSPS-BR-01.02_status":2,"OSPS-BR-01.02_justification":"We have no CI/CD pipeline built in.","OSPS-BR-03.01_status":"Met","OSPS-BR-03.01_justification":"Project URLs use HTTPS exclusively.","OSPS-BR-03.02_status":"Met","OSPS-BR-03.02_justification":"Distribution channels use HTTPS exclusively.","OSPS-BR-07.01_status":"N/A","OSPS-BR-07.01_justification":"We have no sensitive data.","OSPS-DO-01.01_status":"Met","OSPS-DO-02.01_status":"Met","OSPS-GV-02.01_status":"Met","OSPS-GV-03.01_status":"Met","OSPS-LE-02.01_status":"Met","OSPS-LE-02.01_justification":"The GPL-2.0 license for the repository contents is approved by the Open Source Initiative (OSI).","OSPS-LE-02.02_status":"Met","OSPS-LE-03.01_status":"Met","OSPS-LE-03.02_status":"Met","OSPS-QA-01.01_status":"Met","OSPS-QA-01.02_status":"Met","OSPS-QA-02.01_status":"Met","OSPS-QA-04.01_status":"N/A","OSPS-QA-04.01_justification":"No subprojects.","OSPS-QA-05.01_status":"Met","OSPS-QA-05.02_status":"Met","OSPS-VM-02.01_status":"Met","OSPS-AC-04.01_status":"N/A","OSPS-AC-04.01_justification":"No CI/CD tasks are supported.","OSPS-BR-02.01_status":"Met","OSPS-BR-04.01_status":"Met","OSPS-BR-05.01_status":"Met","OSPS-BR-06.01_status":"Met","OSPS-DO-06.01_status":"N/A","OSPS-DO-06.01_justification":"We have no dependencies.","OSPS-GV-01.01_status":"N/A","OSPS-GV-01.01_justification":"We have no sensitive resources.","OSPS-GV-01.02_status":"Met","OSPS-GV-03.02_status":"Met","OSPS-LE-01.01_status":"Met","OSPS-QA-03.01_status":"N/A","OSPS-QA-03.01_justification":"We have no automated status checks.","OSPS-QA-06.01_status":"N/A","OSPS-QA-06.01_justification":"We have no CI/CD pipelines.","OSPS-SA-01.01_status":"N/A","OSPS-SA-01.01_justification":"We have no actions or actors.","OSPS-SA-02.01_status":"Met","OSPS-SA-03.01_status":"N/A","OSPS-SA-03.01_justification":"We can not dictate use, so we can not determine your security problems.","OSPS-VM-01.01_status":"Met","OSPS-VM-03.01_status":"Met","OSPS-VM-04.01_status":"Met","OSPS-AC-04.02_status":"N/A","OSPS-AC-04.02_justification":"We have no CI/CD pipeline.","OSPS-BR-02.02_status":"Met","OSPS-BR-07.02_status":"N/A","OSPS-BR-07.02_justification":"We have have no secrets or credentials.","OSPS-DO-03.01_status":"Met","OSPS-DO-03.02_status":"Met","OSPS-DO-04.01_status":"Met","OSPS-DO-05.01_status":"Met","OSPS-GV-04.01_status":"N/A","OSPS-GV-04.01_justification":"We have no sensitive resources.","OSPS-QA-02.02_status":"N/A","OSPS-QA-02.02_justification":"We have no compiled released software assets.","OSPS-QA-04.02_status":"N/A","OSPS-QA-04.02_justification":"We have no subprojects.","OSPS-QA-06.02_status":"N/A","OSPS-QA-06.02_justification":"We run no tests.","OSPS-QA-06.03_status":"N/A","OSPS-QA-06.03_justification":"We do not have this requirement, as it is not necessary.","OSPS-QA-07.01_status":"Met","OSPS-QA-07.01_justification":"Not a requirement, but a very very strong suggestion.","OSPS-SA-03.02_status":"N/A","OSPS-SA-03.02_justification":"We can not dictate use, so we can not provide threat modeling for how you might use our software.","OSPS-VM-04.02_status":"N/A","OSPS-VM-04.02_justification":"We do not have software components not affecting the project.","OSPS-VM-05.01_status":"N/A","OSPS-VM-05.01_justification":"We can not dictate use, so we can not define your policy for you.","OSPS-VM-05.02_status":"N/A","OSPS-VM-05.02_justification":"We can not dictate use, so we can not define such a policy.","OSPS-VM-05.03_status":"N/A","OSPS-VM-05.03_justification":"We do not have dependencies.","OSPS-VM-06.01_status":"N/A","OSPS-VM-06.01_justification":"We can not dictate use, so we can not define any SAST findings for you.","OSPS-VM-06.02_status":"N/A","OSPS-VM-06.02_justification":"We can not dictate use, so we can not determine exploitable or not exploitable issues.","badge_percentage_baseline_1":100,"badge_percentage_baseline_2":100,"badge_percentage_baseline_3":100,"achieved_baseline_1_at":"2026-06-27T07:53:56.464Z","achieved_baseline_2_at":"2026-06-27T07:54:24.841Z","achieved_baseline_3_at":"2026-06-27T07:57:08.249Z","lost_baseline_1_at":"2026-06-26T18:54:57.793Z","lost_baseline_2_at":"2026-06-26T18:54:57.793Z","lost_baseline_3_at":null,"first_achieved_baseline_1_at":"2026-02-25T23:32:58.052Z","first_achieved_baseline_2_at":"2026-02-25T23:36:22.921Z","first_achieved_baseline_3_at":"2026-06-27T07:57:08.249Z","baseline_tiered_percentage":300,"entry_locale":"en","passing_saved":true,"silver_saved":true,"gold_saved":true,"baseline_1_saved":true,"baseline_2_saved":true,"baseline_3_saved":true,"OSPS-BR-01.03_status":"N/A","OSPS-BR-01.03_justification":"kernel.org does not provide a CI/CD pipeline.","OSPS-DO-07.01_status":"Met","OSPS-BR-01.04_status":"N/A","OSPS-BR-01.04_justification":"kernel.org does not have a CI/CD pipeline.","unreported_badge_loss":0,"unreported_baseline_badge_loss":2,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"gold","additional_rights":[],"project_entry_attribution":"Please credit Greg Kroah-Hartman and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"},{"id":35,"user_id":23,"name":"schema_to_scaffold","description":"Enables \"rails generate scaffold\" to create Rails code that matches an existing database.","homepage_url":"https://github.com/frenesim/schema_to_scaffold","repo_url":"https://github.com/frenesim/schema_to_scaffold","license":"MIT","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","description_good_status":"?","interact_status":"?","contribution_status":"Met","contribution_justification":"Projects on GitHub by default use issues and pull requests, as encouraged by documentation such as \u003chttps://guides.github.com/activities/contributing-to-open-source/\u003e.","contribution_requirements_status":"?","license_location_status":"Met","license_location_justification":"Non-trivial license location file in repository: \u003chttps://github.com/frenesim/schema_to_scaffold/blob/master/LICENSE.txt\u003e.","floss_license_status":"Met","floss_license_justification":"The MIT license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The MIT license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"Unmet","documentation_basics_justification":"No appropriate folder found for documentation basics.","documentation_interface_status":"?","repo_public_status":"Met","repo_public_justification":"Repository on GitHub, which provides public git repositories with URLs.","repo_track_status":"Met","repo_track_justification":"Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"?","repo_distributed_status":"Met","repo_distributed_justification":"Repository on GitHub, which uses git. git is distributed.","version_unique_status":"?","version_semver_status":"?","version_tags_status":"?","release_notes_status":"Met","release_notes_justification":"Non-trivial release notes file in repository: \u003chttps://github.com/frenesim/schema_to_scaffold/blob/master/CHANGELOG.md\u003e.","release_notes_vulns_status":"?","report_url_status":"?","report_url_justification":null,"report_tracker_status":"?","report_process_status":"?","report_responses_status":"?","enhancement_responses_status":"?","report_archive_status":"?","vulnerability_report_process_status":"?","vulnerability_report_private_status":"?","vulnerability_report_response_status":"?","build_status":"Met","build_justification":"Non-trivial build file in repository: \u003chttps://github.com/frenesim/schema_to_scaffold/blob/master/Rakefile\u003e.","build_common_tools_status":"Met","build_common_tools_justification":"Non-trivial build file in repository: \u003chttps://github.com/frenesim/schema_to_scaffold/blob/master/Rakefile\u003e.","build_floss_tools_status":"?","test_status":"?","test_invocation_status":"?","test_most_status":"?","test_policy_status":"?","tests_are_added_status":"?","tests_documented_added_status":"?","warnings_status":"?","warnings_fixed_status":"?","warnings_strict_status":"?","know_secure_design_status":"?","know_common_errors_status":"?","crypto_published_status":"?","crypto_call_status":"?","crypto_floss_status":"?","crypto_keylength_status":"?","crypto_working_status":"?","crypto_pfs_status":"?","crypto_password_storage_status":"?","crypto_random_status":"?","delivery_mitm_status":"?","delivery_unsigned_status":"?","vulnerabilities_fixed_60_days_status":"?","vulnerabilities_critical_fixed_status":"?","static_analysis_status":"?","static_analysis_common_vulnerabilities_status":"?","static_analysis_fixed_status":"?","static_analysis_often_status":"?","dynamic_analysis_status":"?","dynamic_analysis_unsafe_status":"?","dynamic_analysis_enable_assertions_status":"?","dynamic_analysis_fixed_status":"?","general_comments":"","created_at":"2015-11-12T21:57:27.669Z","updated_at":"2017-08-23T19:18:34.511Z","crypto_weaknesses_status":"?","test_continuous_integration_status":"?","cpe":"","discussion_status":"Met","discussion_justification":"GitHub issue tracker and pull requests support discussion","no_leaked_credentials_status":"?","english_status":"Met","hardening_status":"?","crypto_used_network_status":"?","crypto_tls12_status":"?","crypto_certificate_verification_status":"?","crypto_verification_private_status":"?","hardened_site_status":"Met","hardened_site_justification":"Found all required security hardening headers.","installation_common_status":"?","build_reproducible_status":"?","badge_percentage_0":21,"achieved_passing_at":null,"lost_passing_at":null,"last_reminder_at":"2025-05-06T23:00:54.790Z","disabled_reminders":false,"implementation_languages":"Ruby (CII estimate)","lock_version":38,"badge_percentage_1":0,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":4,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Unmet","achieve_silver_status":"Unmet","tiered_percentage":21,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":null,"first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":false,"gold_saved":false,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"in_progress","additional_rights":[],"project_entry_attribution":"Please credit Dan Kohn and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"},{"id":40,"user_id":31,"name":"API Client for Lightspeed Restaurant","description":"Lightspeed Restaurant API Client is a gem for interacting with Lightspeed Restaurant API. Lightspeed Restaurant is point of sale that helps bars, restaurants, and cafés deliver a better customer experience and run a more profitable business.","homepage_url":"https://github.com/chronogolf/lightspeed_restaurant","repo_url":"https://github.com/chronogolf/lightspeed_restaurant","license":"MIT","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","description_good_status":"?","interact_status":"?","contribution_status":"Unmet","contribution_justification":"No contribution file found.","contribution_requirements_status":"?","license_location_status":"Met","license_location_justification":"Non-trivial license location file in repository: \u003chttps://github.com/chronogolf/lightspeed_restaurant/blob/master/LICENSE.txt\u003e.","floss_license_status":"Met","floss_license_justification":"The MIT license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The MIT license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"?","documentation_interface_status":"?","repo_public_status":"?","repo_track_status":"Met","repo_track_justification":"Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"?","repo_distributed_status":"Met","repo_distributed_justification":"Repository on GitHub, which uses git. git is distributed.","version_unique_status":"?","version_semver_status":"?","version_tags_status":"?","release_notes_status":"Unmet","release_notes_justification":"No changelog file found.","release_notes_vulns_status":"?","report_url_status":"?","report_url_justification":null,"report_tracker_status":"?","report_process_status":"?","report_responses_status":"?","enhancement_responses_status":"?","report_archive_status":"?","vulnerability_report_process_status":"?","vulnerability_report_private_status":"?","vulnerability_report_response_status":"?","build_status":"Met","build_justification":"Non-trivial build file in repository: \u003chttps://github.com/chronogolf/lightspeed_restaurant/blob/master/Rakefile\u003e.","build_common_tools_status":"Met","build_common_tools_justification":"Non-trivial build file in repository: \u003chttps://github.com/chronogolf/lightspeed_restaurant/blob/master/Rakefile\u003e.","build_floss_tools_status":"?","test_status":"?","test_invocation_status":"?","test_most_status":"?","test_policy_status":"?","tests_are_added_status":"?","tests_documented_added_status":"?","warnings_status":"?","warnings_fixed_status":"?","warnings_strict_status":"?","know_secure_design_status":"?","know_common_errors_status":"?","crypto_published_status":"?","crypto_call_status":"?","crypto_floss_status":"?","crypto_keylength_status":"?","crypto_working_status":"?","crypto_pfs_status":"?","crypto_password_storage_status":"?","crypto_random_status":"?","delivery_mitm_status":"?","delivery_unsigned_status":"?","vulnerabilities_fixed_60_days_status":"?","vulnerabilities_critical_fixed_status":"?","static_analysis_status":"?","static_analysis_common_vulnerabilities_status":"?","static_analysis_fixed_status":"?","static_analysis_often_status":"?","dynamic_analysis_status":"?","dynamic_analysis_unsafe_status":"?","dynamic_analysis_enable_assertions_status":"?","dynamic_analysis_fixed_status":"?","general_comments":"","created_at":"2015-12-08T15:04:16.641Z","updated_at":"2015-12-08T15:04:16.641Z","crypto_weaknesses_status":"?","test_continuous_integration_status":"?","cpe":null,"discussion_status":"Met","discussion_justification":"GitHub issue tracker and pull requests support discussion","no_leaked_credentials_status":"?","english_status":"Met","hardening_status":"?","crypto_used_network_status":"?","crypto_tls12_status":"?","crypto_certificate_verification_status":"?","crypto_verification_private_status":"?","hardened_site_status":"?","installation_common_status":"?","build_reproducible_status":"?","badge_percentage_0":16,"achieved_passing_at":null,"lost_passing_at":null,"last_reminder_at":"2026-07-09T23:00:52.589Z","disabled_reminders":false,"implementation_languages":"Ruby, Shell (CII estimate)","lock_version":41,"badge_percentage_1":0,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":4,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Unmet","achieve_silver_status":"Unmet","tiered_percentage":16,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":null,"first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":false,"gold_saved":false,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"in_progress","additional_rights":[],"project_entry_attribution":"Please credit Olivier Buffon and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0"},{"id":41,"user_id":64,"name":"byobu","description":"Byobu is a GPLv3 open source text-based window manager and terminal multiplexer. It was originally designed to provide elegant enhancements to the otherwise functional, plain, practical GNU Screen, for the Ubuntu server distribution. Byobu now includes an enhanced profiles, convenient keybindings, configuration utilities, and toggle-able system status notifications for both the GNU Screen window manager and the more modern Tmux terminal multiplexer, and works on most Linux, BSD, and Mac distributions.","homepage_url":"https://byobu.org","repo_url":"https://launchpad.net/byobu","license":"GPL-3.0","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","description_good_status":"Met","interact_status":"Met","interact_justification":"Website contains information on how to obtain the software. Project is hosted on Launchpad, so bug reports and enhancements are per default.","contribution_status":"Met","contribution_justification":"http://byobu.org/source.html","contribution_requirements_status":"Met","contribution_requirements_justification":"http://byobu.org/source.html","license_location_status":"Met","license_location_justification":"Non-trivial license location file in repository: \u003chttps://github.com/dustinkirkland/byobu/blob/master/COPYING\u003e.","floss_license_status":"Met","floss_license_justification":"The GPL-3.0 license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The GPL-3.0 license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"Met","documentation_basics_justification":"Man page: http://bazaar.launchpad.net/~kirkland/byobu/trunk/download/head:/byobu.1-20090505232055-xg34yvd44d9ips2p-1/byobu.1","documentation_interface_status":"Met","documentation_interface_justification":"Keybindings described in /usr/share/doc/byobu page: http://bazaar.launchpad.net/~kirkland/byobu/trunk/download/head:/help.tmux.txt-20111109180841-6hbcf922823ajk8l-1/help.tmux.txt","repo_public_status":"Met","repo_track_status":"Met","repo_track_justification":"Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"Met","repo_distributed_status":"Met","repo_distributed_justification":"Repository on GitHub, which uses git. git is distributed.","version_unique_status":"Met","version_semver_status":"Unmet","version_semver_justification":"major.minor has been sufficient for this project so far.","version_tags_status":"Met","release_notes_status":"Met","release_notes_justification":"http://bazaar.launchpad.net/~kirkland/byobu/trunk/view/head:/debian/changelog","release_notes_vulns_status":"Met","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"Launchpad bugs","report_process_status":"Met","report_process_justification":"Bug reporting via Launchpad documented on http://byobu.org/support.html","report_responses_status":"Met","enhancement_responses_status":"Met","report_archive_status":"Met","report_archive_justification":"https://bugs.launchpad.net/byobu","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"http://byobu.org/support.html","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"Private Launchpad bugs. http://byobu.org/support.html","vulnerability_report_response_status":"Met","build_status":"Met","build_justification":"http://bazaar.launchpad.net/~kirkland/byobu/trunk/view/head:/Makefile.am","build_common_tools_status":"Met","build_common_tools_justification":"autoconf/automake/configure/make driven","build_floss_tools_status":"Met","test_status":"Met","test_justification":"http://bazaar.launchpad.net/~kirkland/byobu/trunk/view/head:/debian/rules","test_invocation_status":"Met","test_most_status":"Unmet","test_policy_status":"Met","tests_are_added_status":"Met","tests_are_added_justification":"http://bazaar.launchpad.net/~kirkland/byobu/trunk/annotate/head:/debian/rules","tests_documented_added_status":"Unmet","warnings_status":"Met","warnings_fixed_status":"Met","warnings_strict_status":"Unmet","know_secure_design_status":"Met","know_common_errors_status":"Met","crypto_published_status":"N/A","crypto_call_status":"N/A","crypto_floss_status":"N/A","crypto_keylength_status":"N/A","crypto_working_status":"N/A","crypto_pfs_status":"N/A","crypto_password_storage_status":"N/A","crypto_random_status":"N/A","delivery_mitm_status":"Met","delivery_unsigned_status":"Met","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_critical_fixed_status":"Met","static_analysis_status":"Met","static_analysis_justification":"pep8 syntax checking, shell syntax checking, bashisms checking","static_analysis_common_vulnerabilities_status":"Unmet","static_analysis_fixed_status":"Met","static_analysis_often_status":"Unmet","dynamic_analysis_status":"Unmet","dynamic_analysis_unsafe_status":"N/A","dynamic_analysis_enable_assertions_status":"Unmet","dynamic_analysis_fixed_status":"Met","general_comments":"","created_at":"2015-12-08T15:40:45.502Z","updated_at":"2018-04-09T01:53:28.534Z","crypto_weaknesses_status":"N/A","test_continuous_integration_status":"Unmet","cpe":"","discussion_status":"Met","discussion_justification":"GitHub issue tracker and pull requests support discussion","no_leaked_credentials_status":"Met","english_status":"Met","hardening_status":"?","crypto_used_network_status":"N/A","crypto_tls12_status":"N/A","crypto_certificate_verification_status":"N/A","crypto_verification_private_status":"N/A","hardened_site_status":"Unmet","hardened_site_justification":"// X-Content-Type-Options was not set to \"nosniff\".","installation_common_status":"?","build_reproducible_status":"Unmet","badge_percentage_0":100,"achieved_passing_at":"2018-04-09T01:53:28.528Z","lost_passing_at":null,"last_reminder_at":"2018-03-14T23:00:54.930Z","disabled_reminders":false,"implementation_languages":"Bash, Python","lock_version":14,"badge_percentage_1":15,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":13,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Met","achieve_silver_status":"Unmet","tiered_percentage":115,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":"2018-04-09T01:53:28.528Z","first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":true,"gold_saved":true,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"passing","additional_rights":[],"project_entry_attribution":"Please credit Dustin Kirkland and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"},{"id":42,"user_id":33,"name":"GitLab","description":"GitLab is the most comprehensive AI-powered DevSecOps platform for software innovation.","homepage_url":"https://about.gitlab.com","repo_url":"https://gitlab.com/gitlab-org/gitlab-foss","license":"MIT","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","description_good_status":"Met","interact_status":"Met","contribution_status":"Met","contribution_justification":"Non-trivial contribution file in repository: https://gitlab.com/gitlab-org/gitlab/-/blob/master/CONTRIBUTING.md","contribution_requirements_status":"Met","contribution_requirements_justification":"https://gitlab.com/gitlab-org/gitlab/-/blob/master/CONTRIBUTING.md","license_location_status":"Met","license_location_justification":"Non-trivial license location file in repository: https://gitlab.com/gitlab-org/gitlab/-/blob/master/LICENSE","floss_license_status":"Met","floss_license_justification":"The MIT license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The MIT license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"Met","documentation_basics_justification":"docs.gitlab.com ","documentation_interface_status":"Met","repo_public_status":"Met","repo_track_status":"Met","repo_track_justification":"Repository on GitLab, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"Met","repo_distributed_status":"Met","repo_distributed_justification":"Repository on GitLab, which uses git. git is distributed.","version_unique_status":"Met","version_semver_status":"Met","version_tags_status":"Met","release_notes_status":"Met","release_notes_justification":"Non-trivial changelog file in repository: https://gitlab.com/gitlab-org/gitlab/-/raw/master/CHANGELOG.md","release_notes_vulns_status":"Met","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_process_status":"Met","report_process_justification":"https://gitlab.com/gitlab-org/gitlab/blob/master/doc/development/contributing/issue_workflow.md#issues-workflow","report_responses_status":"Met","enhancement_responses_status":"Met","report_archive_status":"Met","report_archive_justification":"https://gitlab.com/gitlab-org/gitlab/-/issues","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"https://about.gitlab.com/security/disclosure/","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"https://about.gitlab.com/security/disclosure/","vulnerability_report_response_status":"Met","vulnerability_report_response_justification":"https://about.gitlab.com/security/disclosure/","build_status":"Met","build_justification":"Non-trivial build file in repository: \u003chttps://github.com/gitlabhq/gitlabhq/blob/master/Rakefile\u003e.","build_common_tools_status":"Met","build_common_tools_justification":"Non-trivial build file in repository: \u003chttps://github.com/gitlabhq/gitlabhq/blob/master/Rakefile\u003e.","build_floss_tools_status":"Met","test_status":"Met","test_invocation_status":"Met","test_most_status":"Met","test_policy_status":"Met","tests_are_added_status":"Met","tests_documented_added_status":"Met","warnings_status":"N/A","warnings_fixed_status":"N/A","warnings_strict_status":"N/A","know_secure_design_status":"Met","know_common_errors_status":"Met","crypto_published_status":"Met","crypto_call_status":"Met","crypto_floss_status":"Met","crypto_keylength_status":"Met","crypto_working_status":"Met","crypto_pfs_status":"Met","crypto_password_storage_status":"Met","crypto_random_status":"Met","delivery_mitm_status":"Met","delivery_unsigned_status":"Met","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_critical_fixed_status":"Met","static_analysis_status":"Met","static_analysis_justification":"RuboCop, ESLint, Semgrep, and GitLab Code Quality are used. ","static_analysis_common_vulnerabilities_status":"Met","static_analysis_fixed_status":"Met","static_analysis_often_status":"Met","dynamic_analysis_status":"Met","dynamic_analysis_unsafe_status":"Met","dynamic_analysis_enable_assertions_status":"Met","dynamic_analysis_fixed_status":"Met","general_comments":"See the [GitLab handbook](https://about.gitlab.com/handbook/); [here's a discussion on why the handbook is open source](https://about.gitlab.com/2016/07/12/our-handbook-is-open-source-heres-why/).","created_at":"2015-12-08T22:53:25.990Z","updated_at":"2025-11-14T21:10:23.464Z","crypto_weaknesses_status":"Met","test_continuous_integration_status":"Met","cpe":"","discussion_status":"Met","no_leaked_credentials_status":"Met","english_status":"Met","hardening_status":"?","crypto_used_network_status":"?","crypto_tls12_status":"?","crypto_certificate_verification_status":"?","crypto_verification_private_status":"?","hardened_site_status":"Unmet","hardened_site_justification":"Required security hardening headers missing: https://about.gitlab.com: content-security-policy, strict-transport-security, x-content-type-options, x-frame-options Required security hardening headers missing: https://about.gitlab.com: content-security-policy, x-content-type-options, x-frame-options","installation_common_status":"?","build_reproducible_status":"?","badge_percentage_0":100,"achieved_passing_at":"2025-11-14T21:03:54.682Z","lost_passing_at":"2021-04-11T18:16:17.342Z","last_reminder_at":"2025-08-04T23:00:28.874Z","disabled_reminders":false,"implementation_languages":"","lock_version":25,"badge_percentage_1":4,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":4,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Met","achieve_silver_status":"Unmet","tiered_percentage":104,"repo_url_updated_at":"2025-11-14T20:58:23.119Z","achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":"2016-01-30T22:49:00.000Z","first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":false,"gold_saved":false,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"passing","additional_rights":[40422],"project_entry_attribution":"Please credit Sytse Sijbrandij and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"},{"id":54,"user_id":29075,"name":"OpenSSL","description":"OpenSSL is an open source project that provides a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It is also a general-purpose cryptography library.","homepage_url":"https://www.openssl-library.org","repo_url":"https://github.com/openssl/openssl","license":"OpenSSL","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","description_good_status":"Met","interact_status":"Met","interact_justification":"https://www.openssl.org/community/","contribution_status":"Met","contribution_justification":"https://www.openssl.org/community/","contribution_requirements_status":"Met","contribution_requirements_justification":"https://www.openssl.org/policies/codingstyle.html","license_location_status":"Met","license_location_justification":"https://github.com/openssl/openssl/blob/master/LICENSE","floss_license_status":"Met","floss_license_justification":"OpenSSL uses an unusual license that is known to be FLOSS.  [GNU's \"Various Licenses and Comments about Them\"](https://www.gnu.org/licenses/license-list.html) lists this as a \"GPL-Incompatible Free Software License\".  It is listed by [Debian](https://www.debian.org/legal/licenses/) as a \"license found in main\", and [Fedora](https://fedoraproject.org/wiki/Licensing:Main?rd=Licensing) lists it as a \"good\" license.","floss_license_osi_status":"Unmet","documentation_basics_status":"Met","documentation_interface_status":"Met","repo_public_status":"Met","repo_track_status":"Met","repo_track_justification":"Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"Met","repo_distributed_status":"Met","repo_distributed_justification":"Repository on GitHub, which uses git. git is distributed.","version_unique_status":"Met","version_semver_status":"Met","version_tags_status":"Met","release_notes_status":"Met","release_notes_justification":"https://www.openssl.org/news/changelog.html","release_notes_vulns_status":"Met","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"https://github.com/openssl/openssl/issues","report_process_status":"Met","report_process_justification":"https://openssl-library.org/community/index.html#bugs","report_responses_status":"Met","enhancement_responses_status":"Met","report_archive_status":"Met","report_archive_justification":"https://github.com/openssl/openssl/issues","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"https://openssl-library.org/news/vulnerabilities/index.html","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"https://www.openssl.org/news/vulnerabilities.html","vulnerability_report_response_status":"Met","build_status":"Met","build_common_tools_status":"Met","build_floss_tools_status":"Met","test_status":"Met","test_justification":"https://github.com/openssl/openssl/tree/master/test","test_invocation_status":"Met","test_most_status":"Met","test_policy_status":"Met","test_policy_justification":"https://wiki.openssl.org/index.php/Unit_Testing","tests_are_added_status":"Met","tests_are_added_justification":"Example commit of tests being added: https://git.openssl.org/?p=openssl.git;a=commitdiff;h=5dc312215fa54b70cc8b4baec933bcc19525bc03","tests_documented_added_status":"Unmet","warnings_status":"Met","warnings_fixed_status":"Met","warnings_strict_status":"Unmet","know_secure_design_status":"Met","know_common_errors_status":"Met","crypto_published_status":"Met","crypto_call_status":"Met","crypto_floss_status":"Met","crypto_keylength_status":"Met","crypto_working_status":"Met","crypto_pfs_status":"Met","crypto_password_storage_status":"Met","crypto_random_status":"Met","delivery_mitm_status":"Met","delivery_unsigned_status":"Met","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_critical_fixed_status":"Met","static_analysis_status":"Met","static_analysis_justification":"https://scan.coverity.com/projects/294","static_analysis_common_vulnerabilities_status":"Met","static_analysis_fixed_status":"Met","static_analysis_often_status":"Met","dynamic_analysis_status":"Met","dynamic_analysis_justification":"https://wiki.openssl.org/index.php/Static_and_Dynamic_Analysis","dynamic_analysis_unsafe_status":"Met","dynamic_analysis_enable_assertions_status":"Unmet","dynamic_analysis_fixed_status":"Met","general_comments":"Note that this badge entry is for the current OpenSSL project.  There is a separate *different* entry for the historical information on [OpenSSL before Heartbleed](https://bestpractices.coreinfrastructure.org/projects/87).\r\n","created_at":"2016-01-25T20:18:15.236Z","updated_at":"2025-08-26T09:07:18.725Z","crypto_weaknesses_status":"Met","test_continuous_integration_status":"Met","test_continuous_integration_justification":"https://github.com/openssl/openssl/actions","cpe":"cpe:2.3:a:openssl:openssl:1.0.1:*:*:*:*:*:*:*","discussion_status":"Met","discussion_justification":"OpenSSL uses rt and provides a guest login.","no_leaked_credentials_status":"Met","english_status":"Met","hardening_status":"?","crypto_used_network_status":"?","crypto_tls12_status":"?","crypto_certificate_verification_status":"?","crypto_verification_private_status":"?","hardened_site_status":"Unmet","hardened_site_justification":"Required security hardening headers missing: https://www.openssl.org: content-security-policy Required security hardening headers missing: https://www.openssl-library.org: content-security-policy","installation_common_status":"?","build_reproducible_status":"?","badge_percentage_0":100,"achieved_passing_at":"2016-02-12T22:09:00.000Z","lost_passing_at":null,"last_reminder_at":null,"disabled_reminders":false,"implementation_languages":"C, Perl, C++, Raku, Assembly, Shell, M4, Python, CMake, eC, Dockerfile, Ruby, sed","lock_version":8,"badge_percentage_1":5,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":13,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Met","achieve_silver_status":"Unmet","tiered_percentage":105,"repo_url_updated_at":"2025-08-25T14:44:59.451Z","achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":"2016-02-12T22:09:00.000Z","first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":false,"gold_saved":true,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"passing","additional_rights":[],"project_entry_attribution":"Please credit Anton Arapov and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"},{"id":63,"user_id":50,"name":"curl","description":"curl is a command line tool and library for internet transfers","homepage_url":"https://curl.se","repo_url":"https://github.com/curl/curl","license":"curl","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","description_good_status":"Met","interact_status":"Met","contribution_status":"Met","contribution_justification":"https://github.com/curl/curl/blob/master/docs/CONTRIBUTE.md","contribution_requirements_status":"Met","contribution_requirements_justification":"https://curl.haxx.se/dev/contribute.html","license_location_status":"Met","license_location_justification":"Non-trivial license location file in repository: \u003chttps://github.com/curl/curl/blob/master/COPYING\u003e.","floss_license_status":"Met","floss_license_justification":"The MIT license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The license is MIT/X The MIT license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"Met","documentation_interface_status":"Met","repo_public_status":"Met","repo_public_justification":"Repository on GitHub, which provides public git repositories with URLs.","repo_track_status":"Met","repo_track_justification":"Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"Met","repo_interim_justification":"We don't do \"interim versions\", but we provide daily snapshots.","repo_distributed_status":"Met","repo_distributed_justification":"Repository on GitHub, which uses git. git is distributed.","version_unique_status":"Met","version_unique_justification":"https://curl.haxx.se/docs/versions.html","version_semver_status":"Met","version_tags_status":"Met","version_tags_justification":"We tag each release with the release version.","release_notes_status":"Met","release_notes_justification":"https://curl.haxx.se/changes.html","release_notes_vulns_status":"Met","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"https://github.com/curl/curl/issues","report_process_status":"Met","report_process_justification":"https://github.com/curl/curl/issues","report_responses_status":"Met","enhancement_responses_status":"Met","report_archive_status":"Met","report_archive_justification":"https://github.com/curl/curl/issues","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"https://curl.haxx.se/dev/security.html","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"https://curl.haxx.se/dev/security.html explains this","vulnerability_report_response_status":"Met","vulnerability_report_response_justification":"We have a proven track record. Initial response time averages in under one hour.","build_status":"Met","build_justification":"automake and cmake both work fine","build_common_tools_status":"Met","build_common_tools_justification":"automake and cmake both work fine","build_floss_tools_status":"Met","test_status":"Met","test_invocation_status":"Met","test_invocation_justification":"make check and make test work https://github.com/curl/curl","test_most_status":"Met","test_policy_status":"Met","tests_are_added_status":"Met","tests_documented_added_status":"Met","tests_documented_added_justification":"This is mentioned","warnings_status":"Met","warnings_fixed_status":"Met","warnings_strict_status":"Met","warnings_strict_justification":"Amen.","know_secure_design_status":"Met","know_common_errors_status":"Met","crypto_published_status":"Met","crypto_call_status":"Met","crypto_call_justification":"We do this, as long as the user doesn't build the library without properly provided libraries that provide those functions.","crypto_floss_status":"Met","crypto_keylength_status":"Met","crypto_working_status":"Met","crypto_working_justification":"We do this, as long as the user doesn't use protocols that REQUIRE the use of such algorithms.","crypto_pfs_status":"Met","crypto_pfs_justification":"We do this, as long as the user use protocols that support such algorithms.","crypto_password_storage_status":"N/A","crypto_password_storage_justification":"curl does not \"cause\" storing of passwords","crypto_random_status":"Met","delivery_mitm_status":"Met","delivery_unsigned_status":"Met","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_critical_fixed_status":"Met","static_analysis_status":"Met","static_analysis_justification":"We run clang tidy in CI,  Coverity weekly, CodeSonar daily plus several other tools.","static_analysis_common_vulnerabilities_status":"Met","static_analysis_common_vulnerabilities_justification":"We run coverity regularly. We run lgtm.com on each push/PR. We run scan-build regularly.","static_analysis_fixed_status":"Met","static_analysis_often_status":"Met","dynamic_analysis_status":"Met","dynamic_analysis_justification":"We use numerous, in CI and manual regular invokes","dynamic_analysis_unsafe_status":"Met","dynamic_analysis_unsafe_justification":"We're part of OSS-Fuzz that fuzz curl non-stop. We run a basic fuzzing round on the code for every push/PR.","dynamic_analysis_enable_assertions_status":"Met","dynamic_analysis_enable_assertions_justification":"See code","dynamic_analysis_fixed_status":"Met","general_comments":"","created_at":"2016-02-15T18:53:27.501Z","updated_at":"2026-05-13T17:14:13.312Z","crypto_weaknesses_status":"Met","crypto_weaknesses_justification":"We do this, as long as the user doesn't use protocols that REQUIRE the use of such algorithms.","test_continuous_integration_status":"Met","test_continuous_integration_justification":"We have 200+ CI jobs for every commit and PR. https://github.com/curl/curl","cpe":"","discussion_status":"Met","discussion_justification":"GitHub supports discussions on issues and pull requests.","no_leaked_credentials_status":"Met","english_status":"Met","hardening_status":"Met","hardening_justification":"We build and run an extensive number of tests using fuzzers and sanitizer flags enabled builds non-stop. https://github.com/curl/curl","crypto_used_network_status":"N/A","crypto_used_network_justification":"curl and libcurl are tools for using all sort of protocols, including the \"insecure\" ones. It would make little sense to disable those by default for all users. We however allow any user to explicitly disable whatever protocol they like.","crypto_tls12_status":"Met","crypto_tls12_justification":"curl supports all TLS versions","crypto_certificate_verification_status":"Met","crypto_certificate_verification_justification":"https://curl.haxx.se/docs/sslcerts.html","crypto_verification_private_status":"Met","crypto_verification_private_justification":"https://curl.haxx.se/docs/sslcerts.html","hardened_site_status":"Met","hardened_site_justification":"We use GitHub and https://curl.se set hardening headers.","installation_common_status":"Met","installation_common_justification":"\"make install\" ... \"make uninstall\"","build_reproducible_status":"Met","build_reproducible_justification":"we have no timestamps or \"moving parts\" https://github.com/curl/curl","badge_percentage_0":100,"achieved_passing_at":"2016-03-24T20:14:00.000Z","lost_passing_at":null,"last_reminder_at":null,"disabled_reminders":false,"implementation_languages":"C","lock_version":51,"badge_percentage_1":100,"dco_status":"Unmet","dco_justification":"We don't believe in the necessity this requirement and won't meet it. We will never be silver level because if this.","governance_status":"Met","governance_justification":"https://curl.haxx.se/docs/governance.html","code_of_conduct_status":"Met","code_of_conduct_justification":"https://curl.haxx.se/docs/code-of-conduct.html","roles_responsibilities_status":"Met","roles_responsibilities_justification":"https://curl.haxx.se/docs/governance.html","access_continuity_status":"Met","access_continuity_justification":"https://curl.haxx.se/docs/governance.html - there is no secret or similar owned by any single individual that risks hurting the project for many days","bus_factor_status":"Met","bus_factor_justification":"https://daniel.haxx.se/blog/2017/08/02/the-curl-bus-factor/ - We're having everything extensively documented and tested. There are no secrets. Tools generally evaluate us at around factor 2.","documentation_roadmap_status":"Met","documentation_roadmap_justification":"https://curl.haxx.se/dev/roadmap.html","documentation_architecture_status":"Met","documentation_architecture_justification":"https://curl.haxx.se/dev/internals.html","documentation_security_status":"Met","documentation_security_justification":"https://curl.haxx.se/libcurl/security.html","documentation_quick_start_status":"Met","documentation_quick_start_justification":"for libcurl: https://curl.haxx.se/libcurl/c/libcurl-tutorial.html","documentation_current_status":"Met","documentation_current_justification":"We make sure docs is fine to some extent with documentation tests, and the rest is manual review.","documentation_achievements_status":"Met","documentation_achievements_justification":"https://curl.haxx.se/","accessibility_best_practices_status":"Met","accessibility_best_practices_justification":"The web site and documentation are straight-forward text-based and don't require fancy UI things. Also using high contrast colors and avoids using images for explanations etc.","internationalization_status":"N/A","internationalization_justification":"This software does not produce text intended for mere humans.","sites_password_security_status":"N/A","sites_password_security_justification":"This project never stores anyone's passwords.","maintenance_or_update_status":"Met","maintenance_or_update_justification":"curl remains backwards compatible at all times so upgrading to the latest should always be possible without breaking functionality!","vulnerability_report_credit_status":"Met","vulnerability_report_credit_justification":"https://curl.haxx.se/docs/security.html","vulnerability_response_process_status":"Met","vulnerability_response_process_justification":"https://curl.haxx.se/dev/secprocess.html","coding_standards_status":"Met","coding_standards_justification":"https://curl.haxx.se/dev/code-style.html","coding_standards_enforced_status":"Met","coding_standards_enforced_justification":"'make checksrc' runs the check (also performed by CI)","build_standard_variables_status":"N/A","build_standard_variables_justification":"The project doesn't host native binaries.","build_preserve_debug_status":"Met","build_preserve_debug_justification":"Debug symbols are preserved if enabled.","build_non_recursive_status":"Met","build_non_recursive_justification":"there are no cross-dependencies in the subdirectories","build_repeatable_status":"Met","build_repeatable_justification":"the curl build procedure is fully reproducible!","installation_standard_variables_status":"Met","installation_standard_variables_justification":"provides autoconf and cmake build systems that both adhere to this","installation_development_quick_status":"Met","installation_development_quick_justification":"sure, build a debug version and install, no problemos","external_dependencies_status":"N/A","external_dependencies_justification":"This project doesn't have any mandatory external dependencies","dependency_monitoring_status":"N/A","dependency_monitoring_justification":"No mandatory external dependencies","updateable_reused_components_status":"Met","updateable_reused_components_justification":"curl -V shows all third party components that are used","interfaces_current_status":"Met","interfaces_current_justification":"curl supports the latest and greatest where such things are available","automated_integration_testing_status":"Met","automated_integration_testing_justification":"travis CI, appveyor and more are used to run 40+ test builds and test runs for each push","regression_tests_added50_status":"Met","regression_tests_added50_justification":"This is normal procedure.","test_statement_coverage80_status":"Met","test_statement_coverage80_justification":"Due to the multi-platform nature of curl, this is very hard to reach. We're at 75% MEASURE coverage, but as shown in travis and elsewhere we do a lot more tests than what the coverage test run includes. Most likely we cover more than 5% extra. See https://coveralls.io/github/curl/curl","test_policy_mandated_status":"Met","test_policy_mandated_justification":"This is what we do","implement_secure_design_status":"Met","implement_secure_design_justification":"We have a strong focus on security and make an effort to development everything with security in mind.","input_validation_status":"N/A","input_validation_justification":"The idea behind these tools is to get input from external source and use to offer a functionality. They can normally not be white nor blacklisted. It's data we use.","crypto_algorithm_agility_status":"Met","crypto_algorithm_agility_justification":"curl supports TLS and SSH crypto, both of which allow for many different cryptographic algorithms to get negotiated","crypto_credential_agility_status":"Met","crypto_credential_agility_justification":"curl and libcurl don't assume anything about where such info is stored","signed_releases_status":"Met","signed_releases_justification":"Using GPG","version_tags_signed_status":"Met","version_tags_signed_justification":"https://github.com/curl/curl","badge_percentage_2":100,"contributors_unassociated_status":"Met","contributors_unassociated_justification":"See commit history analysis https://curl.se/gitstats/authors.html and on github","copyright_per_file_status":"Met","copyright_per_file_justification":"see source, also verified by tests","license_per_file_status":"Met","license_per_file_justification":"see source","small_tasks_status":"Met","small_tasks_justification":"https://github.com/curl/curl/blob/master/docs/HELP-US.md#smaller-tasks","require_2FA_status":"Met","require_2FA_justification":"2fa required on github","secure_2FA_status":"Met","secure_2FA_justification":"what is there to add?","code_review_standards_status":"Met","code_review_standards_justification":"https://curl.se/dev/code-review.html","two_person_review_status":"Met","two_person_review_justification":"see commits","test_statement_coverage90_status":"Met","test_statement_coverage90_justification":"90% coverage of the relevant code can be achieved, but code coverage is hard to measure in the project and is a rather pointless way to measure test quality.","test_branch_coverage80_status":"Met","test_branch_coverage80_justification":"https://github,com/curl/curl","security_review_status":"Met","security_review_justification":"curl has had multiple audits done over the years, see https://curl.se/docs/audits.html","assurance_case_status":"Met","assurance_case_justification":"We detail all things security aspects for users of libcurl here: https://curl.haxx.se/libcurl/security.html we document our security process for the project here_ https://curl.haxx.se/dev/secprocess.html","achieve_passing_status":"Met","achieve_silver_status":"Met","tiered_percentage":300,"repo_url_updated_at":null,"achieved_silver_at":"2020-06-10T21:07:11.307Z","lost_silver_at":null,"achieved_gold_at":"2020-06-13T20:35:54.857Z","lost_gold_at":null,"first_achieved_passing_at":"2016-03-24T20:14:00.000Z","first_achieved_silver_at":"2020-06-10T21:07:11.307Z","first_achieved_gold_at":"2020-06-13T20:35:54.857Z","maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":true,"gold_saved":true,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"gold","additional_rights":[],"project_entry_attribution":"Please credit Daniel Stenberg and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"},{"id":64,"user_id":51,"name":"checker","description":"Checker is a monitoring service that is designed to alert you when things are going wrong with the various things you care about. It has sample jobs that can ping TCP ports and HTTP servers, and you can run any job you care about by writing a python class.","homepage_url":"https://github.com/tomrittervg/checker","repo_url":"https://github.com/tomrittervg/checker","license":"","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","description_good_status":"?","interact_status":"?","contribution_status":"?","contribution_requirements_status":"?","license_location_status":"?","floss_license_status":"?","floss_license_osi_status":"?","documentation_basics_status":"?","documentation_interface_status":"?","repo_public_status":"?","repo_track_status":"?","repo_interim_status":"?","repo_distributed_status":"?","version_unique_status":"?","version_semver_status":"?","version_tags_status":"?","release_notes_status":"?","release_notes_vulns_status":"?","report_url_status":"?","report_url_justification":null,"report_tracker_status":"?","report_process_status":"?","report_responses_status":"?","enhancement_responses_status":"?","report_archive_status":"?","vulnerability_report_process_status":"?","vulnerability_report_private_status":"?","vulnerability_report_response_status":"?","build_status":"?","build_common_tools_status":"?","build_floss_tools_status":"?","test_status":"?","test_invocation_status":"?","test_most_status":"?","test_policy_status":"?","tests_are_added_status":"?","tests_documented_added_status":"?","warnings_status":"?","warnings_fixed_status":"?","warnings_strict_status":"?","know_secure_design_status":"?","know_common_errors_status":"?","crypto_published_status":"?","crypto_call_status":"?","crypto_floss_status":"?","crypto_keylength_status":"?","crypto_working_status":"?","crypto_pfs_status":"?","crypto_password_storage_status":"?","crypto_random_status":"?","delivery_mitm_status":"?","delivery_unsigned_status":"?","vulnerabilities_fixed_60_days_status":"?","vulnerabilities_critical_fixed_status":"?","static_analysis_status":"?","static_analysis_common_vulnerabilities_status":"?","static_analysis_fixed_status":"?","static_analysis_often_status":"?","dynamic_analysis_status":"?","dynamic_analysis_unsafe_status":"?","dynamic_analysis_enable_assertions_status":"?","dynamic_analysis_fixed_status":"?","general_comments":"","created_at":"2016-02-15T20:26:26.672Z","updated_at":"2016-05-19T15:28:54.114Z","crypto_weaknesses_status":"?","test_continuous_integration_status":"?","cpe":"","discussion_status":"?","no_leaked_credentials_status":"?","english_status":"Met","hardening_status":"?","crypto_used_network_status":"?","crypto_tls12_status":"?","crypto_certificate_verification_status":"?","crypto_verification_private_status":"?","hardened_site_status":"?","installation_common_status":"?","build_reproducible_status":"?","badge_percentage_0":4,"achieved_passing_at":null,"lost_passing_at":null,"last_reminder_at":"2026-03-02T23:01:03.098Z","disabled_reminders":false,"implementation_languages":"Python (CII estimate)","lock_version":38,"badge_percentage_1":0,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":0,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Unmet","achieve_silver_status":"Unmet","tiered_percentage":4,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":null,"first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":false,"silver_saved":false,"gold_saved":false,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"in_progress","additional_rights":[],"project_entry_attribution":"Please credit Tom Ritter and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0"},{"id":65,"user_id":52,"name":"HTTP/2 State-Machine based protocol implementation","description":null,"homepage_url":"http://python-hyper.org/h2","repo_url":"https://github.com/python-hyper/hyper-h2","license":"MIT","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Unmet","description_good_status":"?","interact_status":"?","contribution_status":"Met","contribution_justification":"Projects on GitHub by default use issues and pull requests, as encouraged by documentation such as \u003chttps://guides.github.com/activities/contributing-to-open-source/\u003e.","contribution_requirements_status":"?","license_location_status":"Met","license_location_justification":"Non-trivial license location file in repository: \u003chttps://github.com/python-hyper/hyper-h2/blob/master/LICENSE\u003e.","floss_license_status":"Met","floss_license_justification":"The MIT license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The MIT license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"?","documentation_interface_status":"?","repo_public_status":"Met","repo_public_justification":"Repository on GitHub, which provides public git repositories with URLs.","repo_track_status":"Met","repo_track_justification":"Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"?","repo_distributed_status":"Met","repo_distributed_justification":"Repository on GitHub, which uses git. git is distributed.","version_unique_status":"?","version_semver_status":"?","version_tags_status":"?","release_notes_status":"Unmet","release_notes_justification":"No release notes file found.","release_notes_vulns_status":"?","report_url_status":"?","report_url_justification":null,"report_tracker_status":"?","report_process_status":"?","report_responses_status":"?","enhancement_responses_status":"?","report_archive_status":"?","vulnerability_report_process_status":"?","vulnerability_report_private_status":"?","vulnerability_report_response_status":"?","build_status":"Met","build_justification":"Non-trivial build file in repository: \u003chttps://github.com/python-hyper/hyper-h2/blob/master/Makefile\u003e.","build_common_tools_status":"Met","build_common_tools_justification":"Non-trivial build file in repository: \u003chttps://github.com/python-hyper/hyper-h2/blob/master/Makefile\u003e.","build_floss_tools_status":"?","test_status":"?","test_invocation_status":"?","test_most_status":"?","test_policy_status":"?","tests_are_added_status":"?","tests_documented_added_status":"?","warnings_status":"?","warnings_fixed_status":"?","warnings_strict_status":"?","know_secure_design_status":"?","know_common_errors_status":"?","crypto_published_status":"?","crypto_call_status":"?","crypto_floss_status":"?","crypto_keylength_status":"?","crypto_working_status":"?","crypto_pfs_status":"?","crypto_password_storage_status":"?","crypto_random_status":"?","delivery_mitm_status":"?","delivery_unsigned_status":"?","vulnerabilities_fixed_60_days_status":"?","vulnerabilities_critical_fixed_status":"?","static_analysis_status":"?","static_analysis_common_vulnerabilities_status":"?","static_analysis_fixed_status":"?","static_analysis_often_status":"?","dynamic_analysis_status":"?","dynamic_analysis_unsafe_status":"?","dynamic_analysis_enable_assertions_status":"?","dynamic_analysis_fixed_status":"?","general_comments":null,"created_at":"2016-02-15T22:47:53.450Z","updated_at":"2016-05-19T15:28:54.142Z","crypto_weaknesses_status":"?","test_continuous_integration_status":"?","cpe":null,"discussion_status":"Met","discussion_justification":"GitHub supports discussions on issues and pull requests.","no_leaked_credentials_status":"?","english_status":"Met","hardening_status":"?","crypto_used_network_status":"?","crypto_tls12_status":"?","crypto_certificate_verification_status":"?","crypto_verification_private_status":"?","hardened_site_status":"?","installation_common_status":"?","build_reproducible_status":"?","badge_percentage_0":18,"achieved_passing_at":null,"lost_passing_at":null,"last_reminder_at":"2026-03-02T23:01:03.927Z","disabled_reminders":false,"implementation_languages":"Python, Shell, Makefile (CII estimate)","lock_version":41,"badge_percentage_1":0,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":4,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Unmet","achieve_silver_status":"Unmet","tiered_percentage":18,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":null,"first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":false,"gold_saved":false,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"in_progress","additional_rights":[],"project_entry_attribution":"Please credit Cory Benfield and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0"},{"id":66,"user_id":53,"name":"BRL-CAD","description":"BRL-CAD is an open source solid modeling system with interactive 3D geometry editing, high-performance ray tracing for rendering, hybrid representation geometry conversion, and processing for geometric analysis.","homepage_url":"http://brlcad.org","repo_url":"https://svn.code.sf.net/p/brlcad/code/brlcad/trunk","license":"LGPL-2.1","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","sites_https_justification":"https://brlcad.org\r\nhttps://svn.code.sf.net/p/brlcad/code/brlcad/trunk\r\nhttps://sourceforge.net/projects/brlcad/files/\r\nhttps://github.com/BRL-CAD\r\n","description_good_status":"Met","description_good_justification":"http://brlcad.org","interact_status":"Met","interact_justification":"http://svn.code.sf.net/p/brlcad/code/brlcad/trunk/HACKING","contribution_status":"Met","contribution_justification":"http://svn.code.sf.net/p/brlcad/code/brlcad/trunk/HACKING","contribution_requirements_status":"Met","contribution_requirements_justification":"http://svn.code.sf.net/p/brlcad/code/brlcad/trunk/HACKING","license_location_status":"Met","license_location_justification":"http://svn.code.sf.net/p/brlcad/code/brlcad/trunk/COPYING\r\nhttp://svn.code.sf.net/p/brlcad/code/brlcad/trunk/doc/legal/","floss_license_status":"Met","floss_license_justification":"http://svn.code.sf.net/p/brlcad/code/brlcad/trunk/COPYING","floss_license_osi_status":"Met","documentation_basics_status":"Met","documentation_basics_justification":"http://brlcad.org/wiki/Documentation","documentation_interface_status":"Met","documentation_interface_justification":"http://brlcad.org/w/images/c/cf/Introduction_to_MGED.pdf","repo_public_status":"Met","repo_public_justification":"Primary source code resides on SourceForge at https://svn.code.sf.net/p/brlcad/code/brlcad with additional repositories on GitHub at https://github.com/BRL-CAD for infrastructure and model management.\r\n","repo_track_status":"Met","repo_track_justification":"https://sourceforge.net/p/brlcad/code/commit_browser","repo_interim_status":"Met","repo_interim_justification":"All development activity occurs in public source repositories at https://svn.code.sf.net/p/brlcad/code/brlcad and https://github.com/BRL-CAD","repo_distributed_status":"Met","repo_distributed_justification":"BRL-CAD uses both centralized and decentralized development, intentionally using centralized (SVN on Sourceforge) for primary development where we have strict validation and verification (V\u0026V) requirements and a desire for enforced developer interaction inherent with the centralized model.  We used decentralized (GIT on GitHub) for all our other work including website infrastructure, model management, and experimental projects.","version_unique_status":"Met","version_unique_justification":"https://svn.code.sf.net/p/brlcad/code/brlcad/tags/\r\nhttps://sourceforge.net/projects/brlcad/files/BRL-CAD%20Source/\r\n","version_semver_status":"Met","version_tags_status":"Met","release_notes_status":"Met","release_notes_justification":"https://svn.code.sf.net/p/brlcad/code/brlcad/trunk/NEWS\r\n","release_notes_vulns_status":"Met","release_notes_vulns_justification":"https://svn.code.sf.net/p/brlcad/code/brlcad/trunk/ChangeLog","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"https://sourceforge.net/p/brlcad/support-requests/","report_process_status":"Met","report_process_justification":"https://sourceforge.net/p/brlcad/bugs/","report_responses_status":"Met","report_responses_justification":"Majority of bugs have been addressed with discussion, deferral, or fixes:\r\nhttps://sourceforge.net/p/brlcad/bugs/","enhancement_responses_status":"Met","enhancement_responses_justification":"Majority of enhancement requests have been addressed with discussion, rejection, or implementation:\r\nhttps://sourceforge.net/p/brlcad/feature-requests/","report_archive_status":"Met","report_archive_justification":"https://sourceforge.net/p/brlcad/mailman/brlcad-tracker/\r\nhttps://sourceforge.net/p/brlcad/bugs/\r\nhttps://sourceforge.net/p/brlcad/support-requests/\r\nhttps://sourceforge.net/p/brlcad/feature-requests/\r\n","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"https://sourceforge.net/p/brlcad/patches/\r\nhttps://svn.code.sf.net/p/brlcad/code/brlcad/trunk/README\r\n","vulnerability_report_private_status":"N/A","vulnerability_report_private_justification":"Private vulnerability reports are NOT supported.  All reporting should be in the open, but private reporting is available via http://brlcad.org/d/contact and e-mail via https://svn.code.sf.net/p/brlcad/code/brlcad/trunk/README","vulnerability_report_response_status":"Met","vulnerability_report_response_justification":"Most reports have been reviewed.","build_status":"Met","build_justification":"https://svn.code.sf.net/p/brlcad/code/brlcad/trunk/CMakeLists.txt","build_common_tools_status":"Met","build_common_tools_justification":"CMake","build_floss_tools_status":"Met","build_floss_tools_justification":"CMake + GNU Make + LLVM / GCC","test_status":"Met","test_justification":"Unit and System tests (CMake/CTest + C/C++): https://svn.code.sf.net/p/brlcad/code/brlcad/trunk/CTestConfig.cmake\r\nRegression testing (CMake + Shell Scripts): https://svn.code.sf.net/p/brlcad/code/brlcad/trunk/regress\r\nPerformance testing (CMake + Tools): https://svn.code.sf.net/p/brlcad/code/brlcad/trunk/bench\r\n","test_invocation_status":"Met","test_invocation_justification":"https://svn.code.sf.net/p/brlcad/code/brlcad/trunk/CTestConfig.cmake\r\nmake test\r\nmake regress\r\nmake benchmark\r\n","test_most_status":"Met","test_most_justification":"BRL-CAD's testing infrastructure is extensive including low-level unit tests, regression tests, performance tests, and higher-level system integration tests exploring a majority of the most important source code.","test_policy_status":"Met","test_policy_justification":"There is an informal policy of unit testing all new core library functionality.  Evidence of test updates available at\r\nhttps://sourceforge.net/p/brlcad/code/HEAD/tree/brlcad/branches/RELEASE/ChangeLog\r\n","tests_are_added_status":"Met","tests_are_added_justification":"https://sourceforge.net/p/brlcad/code/HEAD/log/?path=/brlcad/trunk/src/libbu/tests\r\nhttps://sourceforge.net/p/brlcad/code/HEAD/log/?path=/brlcad/trunk/src/libbn/tests\r\n","tests_documented_added_status":"Met","tests_documented_added_justification":"http://en.flossmanuals.net/contributors-guide-to-brl-cad/how-to-contribute/\r\nhttp://en.flossmanuals.net/contributors-guide-to-brl-cad/code-overview/\r\n","warnings_status":"Met","warnings_justification":"By default, BRL-CAD's build system enables all standard warnings, many additional warnings, and considers all warnings an error.  BRL-CAD is also integrated with Coverity SCAN and uses other code quality tools for additional reporting during CI validation and periodic code reviews.","warnings_fixed_status":"Met","warnings_fixed_justification":"All warnings are addressed.  They halt compilation by default for all modes of compilation.","warnings_strict_status":"Met","warnings_strict_justification":"Compilation is maximally strict.  Warnings are considered errors.  Actual gcc/clang warnings currently in effect: -pedantic -pedantic-errors -Wall -Wextra -Wundef -Wfloat-equal -Wshadow -Wbad-function-cast -Wdeclaration-after-statement -Wc++-compat -Winline -Wno-long-long -Wno-variadic-macros -Wdocumentation -Wno-c11-extensions -Werror","know_secure_design_status":"Met","know_secure_design_justification":"Several of the core developers are senior professionals with significant secure software design experience.","know_common_errors_status":"Met","know_common_errors_justification":"http://brlcad.org/d/node/96\r\nhttp://blog.coverity.com/2012/02/23/coverity-releases-the-coverity-scan-2011-open-source-integrity-report/\r\n","crypto_published_status":"N/A","crypto_call_status":"N/A","crypto_floss_status":"N/A","crypto_keylength_status":"N/A","crypto_working_status":"N/A","crypto_pfs_status":"N/A","crypto_password_storage_status":"N/A","crypto_random_status":"N/A","delivery_mitm_status":"Met","delivery_mitm_justification":"Delivery is over https.","delivery_unsigned_status":"Met","delivery_unsigned_justification":"Hashes are only available over https.","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_fixed_60_days_justification":"No CVEs for BRL-CAD to date.  Dependencies are checked for CVEs and updated prior to source release.","vulnerabilities_critical_fixed_status":"Met","vulnerabilities_critical_fixed_justification":"No critical vulnerabilities to date.","static_analysis_status":"Met","static_analysis_justification":"https://scan.coverity.com/projects/brl-cad\r\nClang static analyzer, cppcheck, and findbugs are also run regularly.","static_analysis_common_vulnerabilities_status":"Met","static_analysis_common_vulnerabilities_justification":"https://scan.coverity.com/projects/brl-cad","static_analysis_fixed_status":"Met","static_analysis_fixed_justification":"https://scan.coverity.com/projects/brl-cad\r\n","static_analysis_often_status":"Met","static_analysis_often_justification":"Coverity and Clang static analyzer are not yet hooked into daily CI, but BRL-CAD has several other custom static source code analysis checks integrated into the build, part of CI testing, and a regular part of daily development.","dynamic_analysis_status":"Unmet","dynamic_analysis_justification":"Dynamic analysis is not currently part of BRL-CAD's release repertoire, but several tools are used periodically and have been used in the past including gcov, valgrind, dmalloc, and purify.","dynamic_analysis_unsafe_status":"Unmet","dynamic_analysis_unsafe_justification":"Dynamic analysis is not currently part of BRL-CAD's release repertoire, but several tools are used periodically and have been used in the past including gcov, valgrind, dmalloc, and purify.","dynamic_analysis_enable_assertions_status":"Unmet","dynamic_analysis_enable_assertions_justification":"Dynamic analysis is not currently part of BRL-CAD's release repertoire, but several tools are used periodically and have been used in the past including gcov, valgrind, dmalloc, and purify.","dynamic_analysis_fixed_status":"Met","dynamic_analysis_fixed_justification":"See no evil, do no evil.","general_comments":"","created_at":"2016-02-16T19:22:11.345Z","updated_at":"2016-08-26T22:10:07.543Z","crypto_weaknesses_status":"N/A","test_continuous_integration_status":"Met","test_continuous_integration_justification":"BuildBot is used for CI.  The \"distcheck-full\" target in BRL-CAD's build system are run on BRL-CAD's central (SVN) code repository.\r\n","cpe":"cpe:2.3:a:brlcad:brlcad:-:*:*:*:*:*:*:*","discussion_status":"Met","discussion_justification":"https://sourceforge.net/projects/brlcad/support","no_leaked_credentials_status":"Met","english_status":"Met","english_justification":"http://brlcad.org/wiki/Documentation\r\nhttps://sourceforge.net/projects/brlcad/support\r\n","hardening_status":"Met","hardening_justification":"BRL-CAD extensively uses compiler flags (including -fstack-protector) and static analysis tools (Coverity) to minimize or eliminate undefined behavior.  BRL-CAD has extensive testing strategies in place to detect security issues and unexpected behavior.","crypto_used_network_status":"Met","crypto_used_network_justification":"There is un unencrypted network communication with an encrypted equivalent.","crypto_tls12_status":"N/A","crypto_tls12_justification":"There is no SSL / TLS communication in BRL-CAD.","crypto_certificate_verification_status":"N/A","crypto_certificate_verification_justification":"There is no SSL / TLS communication in BRL-CAD.","crypto_verification_private_status":"N/A","crypto_verification_private_justification":"There is no SSL / TLS communication in BRL-CAD.","hardened_site_status":"Unmet","hardened_site_justification":"SourceForge supports X-Content-Type-Options nosniff.  GitHub supports multiple.  Project website and download site support none.","installation_common_status":"Met","installation_common_justification":"CMake build system provides for installation and uninstallation.","build_reproducible_status":"Unmet","build_reproducible_justification":"Reproducible builds are not currently supported as timestamps are intentionally embedded into all libraries and (by extension) all binaries.","badge_percentage_0":100,"achieved_passing_at":"2016-08-22T03:14:40.662Z","lost_passing_at":null,"last_reminder_at":null,"disabled_reminders":false,"implementation_languages":"","lock_version":7,"badge_percentage_1":24,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":22,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Met","achieve_silver_status":"Unmet","tiered_percentage":124,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":"2016-08-22T03:14:40.662Z","first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":true,"gold_saved":true,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"passing","additional_rights":[],"project_entry_attribution":"Please credit Christopher Sean Morrison and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0"},{"id":67,"user_id":54,"name":"freewvs","description":"freewvs is a tool to search webroots for know vulnerable versions of web applications","homepage_url":"https://freewvs.schokokeks.org","repo_url":"https://git.schokokeks.org/git/freewvs.git","license":"0BSD","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","description_good_status":"Met","interact_status":"Met","interact_justification":"https://git.schokokeks.org/freewvs.git/blob/master/CONTRIBUTIONS.md","contribution_status":"Met","contribution_justification":"https://git.schokokeks.org/freewvs.git/blob/master/CONTRIBUTIONS.md","contribution_requirements_status":"Met","contribution_requirements_justification":"https://git.schokokeks.org/freewvs.git/blob/master/CONTRIBUTIONS.md","license_location_status":"Met","license_location_justification":"https://git.schokokeks.org/freewvs.git/blob/master/COPYING","floss_license_status":"Met","floss_license_osi_status":"Met","documentation_basics_status":"Met","documentation_basics_justification":"https://git.schokokeks.org/freewvs.git","documentation_interface_status":"Met","repo_public_status":"Met","repo_track_status":"Met","repo_interim_status":"Met","repo_distributed_status":"Met","version_unique_status":"Met","version_semver_status":"?","version_tags_status":"Met","release_notes_status":"Met","release_notes_vulns_status":"Met","release_notes_vulns_justification":"We didn't have any known CVEs in the past, but we would if any severe security vulnerability shows up.","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"https://github.com/schokokeksorg/freewvs/issues","report_process_status":"Met","report_process_justification":"https://git.schokokeks.org/freewvs.git/blob/master/CONTRIBUTIONS.md","report_responses_status":"Met","enhancement_responses_status":"Met","report_archive_status":"Met","report_archive_justification":"https://github.com/schokokeksorg/freewvs/issues","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"https://git.schokokeks.org/freewvs.git/blob/master/CONTRIBUTIONS.md","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"https://git.schokokeks.org/freewvs.git/blob/master/CONTRIBUTIONS.md\r\nhttps://schokokeks.org/kontakt","vulnerability_report_response_status":"Met","build_status":"Met","build_justification":"Project is in python, which is a scripting language, so there is no build, but we use setup.py/setuptools to create wheel packages.","build_common_tools_status":"Met","build_floss_tools_status":"Met","test_status":"Met","test_invocation_status":"Met","test_invocation_justification":"python -m unittest","test_most_status":"Met","test_policy_status":"?","tests_are_added_status":"?","tests_documented_added_status":"?","warnings_status":"Met","warnings_justification":"dlint","warnings_fixed_status":"Met","warnings_fixed_justification":"We regularly run the tool with PYTHONWARNINGS=d enabled and fix all warnings.","warnings_strict_status":"Met","know_secure_design_status":"Met","know_common_errors_status":"Met","crypto_published_status":"N/A","crypto_call_status":"N/A","crypto_floss_status":"N/A","crypto_keylength_status":"N/A","crypto_working_status":"N/A","crypto_pfs_status":"N/A","crypto_password_storage_status":"N/A","crypto_random_status":"N/A","delivery_mitm_status":"Met","delivery_unsigned_status":"Met","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_critical_fixed_status":"Met","static_analysis_status":"Met","static_analysis_justification":"dlint","static_analysis_common_vulnerabilities_status":"Met","static_analysis_common_vulnerabilities_justification":"dlint","static_analysis_fixed_status":"Met","static_analysis_often_status":"Met","dynamic_analysis_status":"?","dynamic_analysis_unsafe_status":"N/A","dynamic_analysis_enable_assertions_status":"?","dynamic_analysis_fixed_status":"?","general_comments":"","created_at":"2016-02-16T23:57:45.000Z","updated_at":"2025-03-22T18:21:36.718Z","crypto_weaknesses_status":"N/A","test_continuous_integration_status":"Met","test_continuous_integration_justification":"https://travis-ci.org/github/schokokeksorg/freewvs","cpe":"","discussion_status":"Met","discussion_justification":"https://github.com/schokokeksorg/freewvs/issues","no_leaked_credentials_status":"Met","english_status":"Met","hardening_status":"?","crypto_used_network_status":"?","crypto_tls12_status":"?","crypto_certificate_verification_status":"?","crypto_verification_private_status":"?","hardened_site_status":"Unmet","hardened_site_justification":"// X-Content-Type-Options was not set to \"nosniff\".","installation_common_status":"?","build_reproducible_status":"?","badge_percentage_0":88,"achieved_passing_at":null,"lost_passing_at":null,"last_reminder_at":"2022-08-06T23:00:35.564Z","disabled_reminders":true,"implementation_languages":"Python","lock_version":46,"badge_percentage_1":7,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":4,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Unmet","achieve_silver_status":"Unmet","tiered_percentage":88,"repo_url_updated_at":"2019-12-13T11:26:33.507Z","achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":null,"first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":false,"gold_saved":false,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"in_progress","additional_rights":[],"project_entry_attribution":"Please credit Hanno Böck and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"},{"id":69,"user_id":34,"name":"The Assimilation Project","description":"The Assimilation Project discovers and keeps updated deep-dive information about your infrastructure then drives various actions directly from discovery. These include evaluation against best practices like security (compliance), monitoring, alerting, network management and CMDB (configuration management database) functions.","homepage_url":"http://AssimProj.org","repo_url":"https://github.com/assimilation/assimilation-official","license":"GPL-3.0+","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Unmet","description_good_status":"Met","description_good_justification":"http://linux-ha.org/source-doc/assimilation/html/index.html","interact_status":"Met","interact_justification":"http://linux-ha.org/source-doc/assimilation/html/_contributing.html","contribution_status":"Met","contribution_justification":"Projects on GitHub by default use issues and pull requests, as encouraged by documentation such as \u003chttps://guides.github.com/activities/contributing-to-open-source/\u003e.","contribution_requirements_status":"Met","contribution_requirements_justification":"http://linux-ha.org/source-doc/assimilation/html/_contributing.html\r\nhttp://linux-ha.org/source-doc/assimilation/html/_coding_standards.html","license_location_status":"Met","license_location_justification":"https://github.com/assimilation/assimilation-official/blob/master/legal/COPYING","floss_license_status":"Met","floss_license_justification":"https://github.com/assimilation/assimilation-official/blob/master/legal/COPYING","floss_license_osi_status":"Met","documentation_basics_status":"Met","documentation_basics_justification":"http://linux-ha.org/source-doc/assimilation/html/_getting_started.html","documentation_interface_status":"Met","documentation_interface_justification":"http://assimilationsystems.com/2016/03/04/fifteen-minutes-to-better-security/","repo_public_status":"Met","repo_public_justification":"Repository on GitHub, which provides public git repositories with URLs.","repo_track_status":"Met","repo_track_justification":"Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"Met","repo_interim_justification":"https://github.com/assimilation/assimilation-official/releases","repo_distributed_status":"Met","repo_distributed_justification":"Repository on GitHub, which uses git. git is distributed.","version_unique_status":"Met","version_semver_status":"Met","version_tags_status":"Met","version_tags_justification":"https://github.com/assimilation/assimilation-official/releases","release_notes_status":"Met","release_notes_justification":"https://github.com/assimilation/assimilation-official/releases","release_notes_vulns_status":"Met","release_notes_vulns_justification":"There are currently none.","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"GitHub Issues, or better yet Trello issues board: https://trello.com/b/98QrdEK1/issues-bugs","report_process_status":"Met","report_process_justification":"GitHub, Trello, mailing list. https://trello.com/b/98QrdEK1/issues-bugs","report_responses_status":"Met","report_responses_justification":"https://github.com/assimilation/assimilation-official/issues\r\nhttps://trello.com/b/98QrdEK1/issues-bugs","enhancement_responses_status":"Met","enhancement_responses_justification":"Through Trello primarily. https://trello.com/b/98QrdEK1/issues-bugs","report_archive_status":"Met","report_archive_justification":"https://trello.com/b/98QrdEK1/issues-bugs http://lists.community.tummy.com/cgi-bin/mailman/listinfo/assimilation\r\nhttp://lists.community.tummy.com/pipermail/assimilation/\r\nhttp://dir.gmane.org/gmane.comp.monitoring.assimilation","vulnerability_report_process_status":"?","vulnerability_report_private_status":"?","vulnerability_report_response_status":"Met","vulnerability_report_response_justification":"There haven't been any yet.","build_status":"Met","build_justification":"Non-trivial build file in repository: \u003chttps://github.com/assimilation/assimilation-official/blob/master/CMakeLists.txt\u003e.\r\n\r\nBetter yet: cd docker; ./builditall -- will build versions for 12 different versions of Linux.","build_common_tools_status":"Met","build_common_tools_justification":"Non-trivial build file in repository: \u003chttps://github.com/assimilation/assimilation-official/blob/master/CMakeLists.txt\u003e.","build_floss_tools_status":"Met","build_floss_tools_justification":"It builds and passes tests on 12 different versions of Linux, all using tools available through Docker and","test_status":"Met","test_justification":"cd cma; testify tests","test_invocation_status":"Met","test_invocation_justification":"cd cma; testify tests\r\n\r\nThis runs *all* the tests. Some are in C, some are in Python, some are in Python+C, and some are in the shell. This runs them all.","test_most_status":"Unmet","test_most_justification":"It's not OK. It's just unmet.","test_policy_status":"Met","test_policy_justification":"It's understood, but not well documented. The most common external code is discovery scripts, and they're documented by this article: http://assimilationsystems.com/2016/02/13/write-an-assimilation-discovery-agent/","tests_are_added_status":"Met","tests_are_added_justification":"Tests were added for the most recent major change - sending events for changes in compliance. Also made up a deficit from early in the project where there were no tests for LLDP or CDP packet processing.","tests_documented_added_status":"Unmet","tests_documented_added_justification":"It's not OK. Just unmet.","warnings_status":"Met","warnings_justification":"We use three methods for this: (1) coverity + clang-analysis for C code, pylint for Python programs. Clang and pylint are part of the normal submit routine. Coverity gets run before every major release. We also run all the tests to complain if all objects are not freed, and in addition we run a few of the C-only tests under Valgrind. Tests fail if Valgrind doesn't like it, or if we don't free memory (under the Python tests).","warnings_fixed_status":"Met","warnings_fixed_justification":"Our build procedure declares ALL warnings as errors.","warnings_strict_status":"Met","warnings_strict_justification":"We turn on every C warning flag that we can, and test for old releases that don't support some of the new ones, and automatically adjust the buidl accordingly. All those warnings are treated as errors.","know_secure_design_status":"Met","know_secure_design_justification":"Alan Robertson has been writing software for nearly 40 years, and has a track record for avoiding security problems.","know_common_errors_status":"Met","know_common_errors_justification":"See above. Coverity also helps catch things that I might have missed.","crypto_published_status":"Met","crypto_published_justification":"Our crypto is provided by libsodium.","crypto_call_status":"Met","crypto_call_justification":"See above.","crypto_floss_status":"Met","crypto_floss_justification":"Libsodium is FLOSS.","crypto_keylength_status":"Met","crypto_keylength_justification":"This is under the control of crypto expert Dan Bernstein.","crypto_working_status":"Met","crypto_working_justification":"We only use libsodium for crypto.","crypto_pfs_status":"N/A","crypto_pfs_justification":"Our keys are distributed through a different mechanism - the same that installs the software.","crypto_password_storage_status":"N/A","crypto_password_storage_justification":"We don't store passwords.","crypto_random_status":"N/A","crypto_random_justification":"Libsodium takes care of this for us.","delivery_mitm_status":"Met","delivery_mitm_justification":"We use https currently. We will switch to signed packages.","delivery_unsigned_status":"Met","delivery_unsigned_justification":"We don't retrieve cryptographic hashes.","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_fixed_60_days_justification":"There aren't any.","vulnerabilities_critical_fixed_status":"Met","vulnerabilities_critical_fixed_justification":"There haven't been any yet.","static_analysis_status":"Met","static_analysis_justification":"We use coverity and clang-analyzer for C. I don't know of one for Python. Here is our Coverity project URL:  https://scan.coverity.com/projects/assimilation-system-management-suite","static_analysis_common_vulnerabilities_status":"Met","static_analysis_common_vulnerabilities_justification":"Coverity does this.","static_analysis_fixed_status":"Met","static_analysis_fixed_justification":"Check the stats here: https://scan.coverity.com/projects/assimilation-system-management-suite","static_analysis_often_status":"Met","static_analysis_often_justification":"The C code is pretty stable. It changes only rarely nowadays.","dynamic_analysis_status":"Met","dynamic_analysis_justification":"I use both a home-grown fuzzing tool \"Fuzzy Monkey\" testing... http://assimilationsystems.com/2016/05/24/testing-distributed-systems-with-fuzzy-monkey-testing/","dynamic_analysis_unsafe_status":"Met","dynamic_analysis_unsafe_justification":"We run the C-level tests under valgrind - as noted before.","dynamic_analysis_enable_assertions_status":"Met","dynamic_analysis_fixed_status":"Met","dynamic_analysis_fixed_justification":"There haven't been any.","general_comments":"Note that we use both [GitHub](https://github.com/assimilation/assimilation-official) _and_ [Trello](https://trello.com/b/98QrdEK1/issues-bugs) for project bug reports. We also have a [mailing list](http://lists.community.tummy.com/cgi-bin/mailman/listinfo/assimilation) for interactive discussion, and there is also a [blog](http://assimilationsystems.com/category/blog/) for documentation and announcements about the project.","created_at":"2016-02-24T21:31:43.477Z","updated_at":"2016-08-12T18:42:07.368Z","crypto_weaknesses_status":"Met","crypto_weaknesses_justification":"We only use libsodium for crypto.","test_continuous_integration_status":"Met","test_continuous_integration_justification":"Travis-ci builds and runs tests automaticlaly. The builditall script will do the same thing for 12 versions of Linux.","cpe":"","discussion_status":"Met","discussion_justification":"GitHub supports discussions on issues and pull requests. In addition, we make extensive use of Trello boards - like this one for issues and/or bugs: https://trello.com/b/98QrdEK1/issues-bugs Issues created in GitHub are automatically replicated to Trello.","no_leaked_credentials_status":"Met","english_status":"Met","english_justification":"http://assimilationsystems.com/2016/03/04/fifteen-minutes-to-better-security/\r\nhttps://github.com/assimilation/assimilation-official/issues\r\nhttps://trello.com/b/98QrdEK1/issues-bugs","hardening_status":"?","crypto_used_network_status":"?","crypto_tls12_status":"?","crypto_certificate_verification_status":"?","crypto_verification_private_status":"?","hardened_site_status":"?","installation_common_status":"?","build_reproducible_status":"?","badge_percentage_0":96,"achieved_passing_at":null,"lost_passing_at":null,"last_reminder_at":"2026-04-25T23:01:03.976Z","disabled_reminders":false,"implementation_languages":"Python, C, Shell (CII estimate)","lock_version":43,"badge_percentage_1":11,"dco_status":"?","governance_status":"?","code_of_conduct_status":"?","roles_responsibilities_status":"?","access_continuity_status":"?","bus_factor_status":"?","documentation_roadmap_status":"?","documentation_architecture_status":"?","documentation_security_status":"?","documentation_quick_start_status":"?","documentation_current_status":"?","documentation_achievements_status":"?","accessibility_best_practices_status":"?","internationalization_status":"?","sites_password_security_status":"?","maintenance_or_update_status":"?","vulnerability_report_credit_status":"?","vulnerability_response_process_status":"?","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":9,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Unmet","achieve_silver_status":"Unmet","tiered_percentage":96,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":null,"first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":true,"gold_saved":false,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"in_progress","additional_rights":[],"project_entry_attribution":"Please credit Alan Robertson and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0"},{"id":73,"user_id":57,"name":"The System Integrity Management Project (SIMP)","description":"SIMP is an Open Source, fully automated, and extensively tested framework that can either enhance your existing infrastructure or allow you to quickly build one from scratch. Built on the mature Puppet product suite, SIMP is designed around scalability, flexibility, and compliance. \r\n\r\nInitially designed as a turn-key solution for isolated environments, SIMP includes everything you need to get started building repeatable infrastructures at any scale.","homepage_url":"https://simp-project.com","repo_url":"https://github.com/simp/simp-core","license":"Apache-2.0","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","description_good_status":"Met","description_good_justification":"The main software description can be found at https://simp-project.com.","interact_status":"Met","interact_justification":"The 'Help' link on https://simp-project.com provides a direct avenue for obtaining community support and the https://simp-project.com/#download-now section has direct links to the GitHub spaces, as does the FAQ.","contribution_status":"Met","contribution_justification":"Non-trivial contribution file in repository: \u003chttps://github.com/simp/simp-core/blob/master/CONTRIBUTING.md\u003e.","contribution_requirements_status":"Met","contribution_requirements_justification":"Contribution documentation at https://simp.readthedocs.io/en/master/contributors_guide/index.html","license_location_status":"Met","license_location_justification":"Non-trivial license location file in repository: \u003chttps://github.com/simp/simp-core/blob/master/LICENSE\u003e.","floss_license_status":"Met","floss_license_justification":"The Apache-2.0 license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The Apache-2.0 license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"Met","documentation_basics_justification":"The documentation can be found at https://simp.readthedocs.org","documentation_interface_status":"Met","documentation_interface_justification":"The documentation can be found at https://simp.readthedocs.org","repo_public_status":"Met","repo_public_justification":"Repository on GitHub, which provides public git repositories with URLs.","repo_track_status":"Met","repo_track_justification":"Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"Met","repo_distributed_status":"Met","repo_distributed_justification":"Repository on GitHub, which uses git. git is distributed.","version_unique_status":"Met","version_unique_justification":"All sub-components use Semantic Versioning 2.0.0. The overall build uses a modification to Semantic Versioning that is tied directly to the version of the underlying Operating System. This is covered in the documentation for the product.","version_semver_status":"Met","version_tags_status":"Met","version_tags_justification":"Git tags are used for each release","release_notes_status":"Met","release_notes_justification":"There are changelogs in each package repository for each sub-component as well as a master changelog in the https://github.com/simp/simp-doc project.","release_notes_vulns_status":"Met","release_notes_vulns_justification":"Vulnerabilities that are fixed are specifically noted in each master changelog.","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"All issues are tracked at https://simp-project.atlassian.net.","report_process_status":"Met","report_process_justification":"Bug reports can be submitted at https://simp-project.atlassian.net.","report_responses_status":"Met","report_responses_justification":"Bugs are triaged as they are submitted into the bug tracking system.","enhancement_responses_status":"Met","enhancement_responses_justification":"Enhancement requests are triaged every three weeks.","report_archive_status":"Met","report_archive_justification":"The bug tracking system at https://simp-project.atlassian.net is publicly accessible.","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"Material on reporting security issues is at https://simp.readthedocs.io/en/master/help/Public_Resources.html and a triage process is in place.","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"Per https://github.com/NationalSecurityAgency/SIMP#google-groups, private reports may be sent to the private SIMP security forum at https://groups.google.com/forum/?fromgroups#!forum/simp-security","vulnerability_report_response_status":"Met","build_status":"Met","build_justification":"All components are built and tested using TravisCI and Jenkins. ConcourseCI is on the way.","build_common_tools_status":"Met","build_common_tools_justification":"All components are built and tested using TravisCI and Jenkins. ConcourseCI is on the way.","build_floss_tools_status":"Met","build_floss_tools_justification":"Any system with RVM and 'mock' can build any or all components. Many components are usable in their raw form.","test_status":"Met","test_justification":"All component tests are released as part of the source code.","test_invocation_status":"Met","test_invocation_justification":"All tests can be run using 'rake'","test_most_status":"Met","test_most_justification":"Most critical paths are tested both with unit tests and acceptance tests.","test_policy_status":"Met","test_policy_justification":"If tests are not added, unless the change it trivial, the code review process will flag a need for improvement.","tests_are_added_status":"Met","tests_documented_added_status":"Unmet","tests_documented_added_justification":"Documentation should be updated.","warnings_status":"Met","warnings_justification":"A linter is run on all code to find issues.","warnings_fixed_status":"Met","warnings_fixed_justification":"Warnings are not allowed except where explicitly codified.","warnings_strict_status":"Met","know_secure_design_status":"Met","know_common_errors_status":"Met","crypto_published_status":"Met","crypto_call_status":"Met","crypto_floss_status":"Met","crypto_keylength_status":"Met","crypto_keylength_justification":"The system is Linux kernel enforced FIPS conformant by default.","crypto_working_status":"Met","crypto_pfs_status":"Met","crypto_password_storage_status":"Met","crypto_password_storage_justification":"This is met, but OS and application functionality conformance is maintained where required.","crypto_random_status":"N/A","crypto_random_justification":"This is up to the final implementing user.","delivery_mitm_status":"Met","delivery_unsigned_status":"Met","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_critical_fixed_status":"Met","static_analysis_status":"N/A","static_analysis_justification":"Our production code is mostly Puppet code and a static code analysis tool could not be found to work with Puppet at this time.","static_analysis_common_vulnerabilities_status":"N/A","static_analysis_fixed_status":"N/A","static_analysis_often_status":"N/A","dynamic_analysis_status":"Unmet","dynamic_analysis_unsafe_status":"Unmet","dynamic_analysis_enable_assertions_status":"Unmet","dynamic_analysis_fixed_status":"Met","general_comments":"","created_at":"2016-03-03T01:40:08.304Z","updated_at":"2017-07-22T13:40:23.899Z","crypto_weaknesses_status":"Met","test_continuous_integration_status":"Met","test_continuous_integration_justification":"All components are built and tested using TravisCI and Jenkins. ConcourseCI is on the way.","cpe":"","discussion_status":"Met","discussion_justification":"https://github.com/NationalSecurityAgency/SIMP#community details the methods that are available for freely and openly communicating with the SIMP team.","no_leaked_credentials_status":"Met","english_status":"Met","hardening_status":"Met","crypto_used_network_status":"Met","crypto_used_network_justification":"As applicable RFCs allow.","crypto_tls12_status":"Met","crypto_certificate_verification_status":"Met","crypto_verification_private_status":"Met","hardened_site_status":"Unmet","hardened_site_justification":"Mostly met, GitHub is compliant, BinTray is not but all packages are GPG signed with a public key available from GitHub. X-Content-Type-Options was not set to \"nosniff\".","installation_common_status":"Met","installation_common_justification":"All packages are created using RPM and Puppet module files.","build_reproducible_status":"Met","build_reproducible_justification":"See https://github.com/simp/simp-core for details on building the project","badge_percentage_0":100,"achieved_passing_at":"2017-05-18T16:34:35.871Z","lost_passing_at":null,"last_reminder_at":"2017-05-16T23:00:41.113Z","disabled_reminders":false,"implementation_languages":"Ruby, Puppet, RestructuredText, Shell","lock_version":14,"badge_percentage_1":29,"dco_status":"Unmet","governance_status":"Unmet","code_of_conduct_status":"Unmet","roles_responsibilities_status":"Unmet","access_continuity_status":"Met","access_continuity_justification":"The SIMP project is actively maintained by Onyx Point, Inc. (https://onyxpoint.com)","bus_factor_status":"Met","bus_factor_justification":"https://github.com/orgs/simp/people","documentation_roadmap_status":"Unmet","documentation_architecture_status":"Unmet","documentation_security_status":"Met","documentation_security_justification":"http://simp.readthedocs.io/en/master/security_conop/index.html and http://simp.readthedocs.io/en/master/security_mapping/index.html","documentation_quick_start_status":"Met","documentation_quick_start_justification":"http://simp.readthedocs.io/en/master/getting_started_guide/index.html","documentation_current_status":"Met","documentation_current_justification":"http://simp.readthedocs.io/en/latest/getting_started_guide/index.html","documentation_achievements_status":"Met","documentation_achievements_justification":"https://github.com/simp/simp-core","accessibility_best_practices_status":"N/A","accessibility_best_practices_justification":"There are no GUI or web applications involved in SIMP Core","internationalization_status":"N/A","internationalization_justification":"There is no text generated for end users.","sites_password_security_status":"N/A","sites_password_security_justification":"The project sites do not store user credentials","maintenance_or_update_status":"Unmet","vulnerability_report_credit_status":"Met","vulnerability_report_credit_justification":"Vulnerabilities are tracked under the various system sub-component CHANGELOG files https://github.com/simp","vulnerability_response_process_status":"Met","vulnerability_response_process_justification":"http://simp.readthedocs.io/en/latest/help/Public_Resources.html","coding_standards_status":"?","coding_standards_enforced_status":"?","build_standard_variables_status":"?","build_preserve_debug_status":"?","build_non_recursive_status":"?","build_repeatable_status":"?","installation_standard_variables_status":"?","installation_development_quick_status":"?","external_dependencies_status":"?","dependency_monitoring_status":"?","updateable_reused_components_status":"?","interfaces_current_status":"?","automated_integration_testing_status":"?","regression_tests_added50_status":"?","test_statement_coverage80_status":"?","test_policy_mandated_status":"?","implement_secure_design_status":"?","input_validation_status":"?","crypto_algorithm_agility_status":"?","crypto_credential_agility_status":"?","signed_releases_status":"?","version_tags_signed_status":"?","badge_percentage_2":17,"contributors_unassociated_status":"?","copyright_per_file_status":"?","license_per_file_status":"?","small_tasks_status":"?","require_2FA_status":"?","secure_2FA_status":"?","code_review_standards_status":"?","two_person_review_status":"?","test_statement_coverage90_status":"?","test_branch_coverage80_status":"?","security_review_status":"?","assurance_case_status":"?","achieve_passing_status":"Met","achieve_silver_status":"Unmet","tiered_percentage":129,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":null,"lost_gold_at":null,"first_achieved_passing_at":"2017-05-18T16:34:35.871Z","first_achieved_silver_at":null,"first_achieved_gold_at":null,"maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":true,"gold_saved":true,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"passing","additional_rights":[],"project_entry_attribution":"Please credit Trevor Vaughan and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"},{"id":74,"user_id":1537,"name":"Zephyr Project","description":"The Zephyr Project is a small, scalable real-time operating system for use on resource-constrained systems supporting multiple architectures. Developers are able to tailor their optimal solution. As a true open source project, the community can evolve the Zephyr Project to support new hardware, developer tools, sensor and device drivers. Advancements in security, device management capabilities, connectivity stacks and file systems can be easily implemented. ","homepage_url":"https://www.zephyrproject.org","repo_url":"https://github.com/zephyrproject-rtos/zephyr","license":"Apache-2.0","homepage_url_status":"?","homepage_url_justification":null,"sites_https_status":"Met","sites_https_justification":"https://github.com/zephyrproject-rtos/zephyr\r\nhttps://www.zephyrproject.org","description_good_status":"Met","description_good_justification":"https://www.zephyrproject.org/   -- on the landing page.","interact_status":"Met","interact_justification":"https://www.zephyrproject.org/community/  - The project provides multiple channels to communicate and includes a GitHub instance to track development and report bugs.  https://github.com/zephyrproject-rtos/zephyr/issues","contribution_status":"Met","contribution_justification":"https://www.zephyrproject.org/community/#community-guidelines","contribution_requirements_status":"Met","contribution_requirements_justification":"https://docs.zephyrproject.org/latest/contribute/index.html -- Require contributors to adhere to specific coding styles and guidelines outlined in the project documentation. ","license_location_status":"Met","license_location_justification":"https://github.com/zephyrproject-rtos/zephyr/releases -- Has tags of each release, including source code, with licensing information included\r\nAn overview of the releases can be found on https://www.zephyrproject.org/developer-resources/#current-release","floss_license_status":"Met","floss_license_justification":"The Apache-2.0 license is approved by the Open Source Initiative (OSI). https://opensource.org/licenses/Apache-2.0 The Apache-2.0 license is approved by the Open Source Initiative (OSI).","floss_license_osi_status":"Met","floss_license_osi_justification":"The Apache-2.0 license is approved by the Open Source Initiative (OSI).","documentation_basics_status":"Met","documentation_basics_justification":"https://docs.zephyrproject.org/latest/","documentation_interface_status":"Met","documentation_interface_justification":"This section describes the major features of the Zephyr and how to use them. https://docs.zephyrproject.org/latest/guides/index.html\r\nAlso include an application development primer: https://docs.zephyrproject.org/latest/application/index.html","repo_public_status":"Met","repo_public_justification":"https://github.com/zephyrproject-rtos/zephyr","repo_track_status":"Met","repo_track_justification":"It's a GitHub Repository with Git Issues for issue tracking.  Repository on GitHub, which uses git. git can track the changes, who made them, and when they were made.","repo_interim_status":"Met","repo_interim_justification":"https://github.com/zephyrproject-rtos/zephyr/releases","repo_distributed_status":"Met","repo_distributed_justification":"https://github.com/zephyrproject-rtos/ -- Repository on GitHub, which uses git. git is distributed.","version_unique_status":"Met","version_unique_justification":"https://github.com/zephyrproject-rtos/zephyr/releases","version_semver_status":"Met","version_tags_status":"Met","version_tags_justification":"https://www.zephyrproject.org/developer-resources/#current-release","release_notes_status":"Met","release_notes_justification":"example release note: https://github.com/zephyrproject-rtos/zephyr/releases","release_notes_vulns_status":"Met","release_notes_vulns_justification":" https://github.com/zephyrproject-rtos/zephyr/releases","report_url_status":"?","report_url_justification":null,"report_tracker_status":"Met","report_tracker_justification":"https://github.com/zephyrproject-rtos/zephyr/issues","report_process_status":"Met","report_process_justification":"Project has both GitHub Issues and public mailing lists. https://github.com/zephyrproject-rtos/zephyr/issues  , lists.zephyrproject.org","report_responses_status":"Met","report_responses_justification":"The project has a Technical steering committee that works on reviewing and prioritizing the development work.  There is a security subcommittee to address security issues. ","enhancement_responses_status":"Met","enhancement_responses_justification":"The project has a Technical steering committee that works on reviewing and prioritizing the development work. ","report_archive_status":"Met","report_archive_justification":"Mailing lists have public archives and the GitHub instance.  https://github.com/zephyrproject-rtos/zephyr/issues","vulnerability_report_process_status":"Met","vulnerability_report_process_justification":"Has a security issues and reporting in the readme.rst -- https://github.com/zephyrproject-rtos/zephyr/\r\nhttp://docs.zephyrproject.org/security/security-overview.html","vulnerability_report_private_status":"Met","vulnerability_report_private_justification":"https://docs.zephyrproject.org/latest/security/reporting.html#introduction\r\n\r\nPrivate vulnerability reports are supported and encouraged, bellow is one report done by NCCgroup\r\nhttps://research.nccgroup.com/wp-content/uploads/2020/05/NCC_Group_Zephyr_MCUboot_Research_Report_2020-05-26_v1.0.pdf","vulnerability_report_response_status":"Met","vulnerability_report_response_justification":"We have a security working group that receives the reports and the team is supposed to respond within 7 days.","build_status":"Met","build_justification":"The project provides SDK -- https://github.com/zephyrproject-rtos/sdk-ng/releases","build_common_tools_status":"Met","build_common_tools_justification":"We provide SDK -- https://github.com/zephyrproject-rtos/sdk-ng\r\nAnd Documentation for developers to get started at https://docs.zephyrproject.org/latest/index.html","build_floss_tools_status":"Met","build_floss_tools_justification":"This is open source project build with and on open source development tools.   Here are the instructions to getting setup with your development environment: https://docs.zephyrproject.org/latest/getting_started/index.html","test_status":"Met","test_justification":"Twister tool that's part of the source code,runs all the test for the supported boards and platforms. The build system also runs this sanity check. \r\nhttps://github.com/zephyrproject-rtos/zephyr/tree/main/tests\r\n","test_invocation_status":"Met","test_invocation_justification":"python script that is called to run test cases written in standard C. see https://github.com/zephyrproject-rtos/zephyr/blob/main/CONTRIBUTING.rst (twister)","test_most_status":"Unmet","test_most_justification":"This is a work in progress","test_policy_status":"Met","test_policy_justification":"This process is established by the core development team and outlined in the documentation. http://docs.zephyrproject.org/index.html","tests_are_added_status":"Met","tests_are_added_justification":"This is documented in the commit logs and pull requests. https://github.com/zephyrproject-rtos/zephyr/issues","tests_documented_added_status":"Met","tests_documented_added_justification":"https://github.com/zephyrproject-rtos/zephyr/blob/main/CONTRIBUTING.rst","warnings_status":"Met","warnings_justification":"Yes,  Uses gcc warning - defaults to ----,  build system supports 3 levels of warnings make W=1, -W=2, W=3.","warnings_fixed_status":"Met","warnings_fixed_justification":"Build system generates warnings and fails until it's fixed. ","warnings_strict_status":"Met","warnings_strict_justification":"Build system statically compiles and fails when met with warnings. CI also catch potential issues before being accepted into the code. ","know_secure_design_status":"Met","know_secure_design_justification":"We have a security sub committee dedicated to monitoring and ensuring security best practices are followed. ","know_common_errors_status":"Met","know_common_errors_justification":"We have a security team comprising of experts in the space. ","crypto_published_status":"Met","crypto_published_justification":"Application uses PSA Crypto or mbedTLS libraries to manage cryptography with members of security working group actively participating in these projects.","crypto_call_status":"Met","crypto_call_justification":"Uses mbedTLS https://github.com/ARMmbed/mbedtls","crypto_floss_status":"Met","crypto_keylength_status":"Met","crypto_keylength_justification":"\r\nSHA-256:\r\nType of primitive: Hash function.\r\nStandard Specification: NIST FIPS PUB 180-4.\r\nRequires: –\r\nHMAC-SHA256:\r\nType of primitive: Message authentication code.\r\nStandard Specification: RFC 2104.\r\nRequires: SHA-256\r\nHMAC-PRNG:\r\nType of primitive: Pseudo-random number generator.\r\nStandard Specification: NIST SP 800-90A.\r\nRequires: SHA-256 and HMAC-SHA256.\r\nAES-128:\r\nType of primitive: Block cipher.\r\nStandard Specification: NIST FIPS PUB 197.\r\nRequires: –\r\nAES-CBC mode:\r\nType of primitive: Encryption mode of operation.\r\nStandard Specification: NIST SP 800-38A.\r\nRequires: AES-128.\r\nAES-CTR mode:\r\nType of primitive: Encryption mode of operation.\r\nStandard Specification: NIST SP 800-38A.\r\nRequires: AES-128.\r\nAES-CMAC mode:\r\nType of primitive: Message authentication code.\r\nStandard Specification: NIST SP 800-38B.\r\nRequires: AES-128.\r\nAES-CCM mode:\r\nType of primitive: Authenticated encryption.\r\nStandard Specification: NIST SP 800-38C.\r\nRequires: AES-128.\r\nECC-DH:\r\nType of primitive: Key exchange.\r\nStandard Specification: RFC 6090.\r\nRequires: ECC auxiliary functions (ecc.h/c).\r\nECC-DSA:\r\nType of primitive: Digital signature.\r\nStandard Specification: RFC 6090.\r\nRequires: ECC auxiliary functions (ecc.h/c).","crypto_working_status":"Met","crypto_pfs_status":"Met","crypto_password_storage_status":"N/A","crypto_password_storage_justification":"Statically compiled binary, no user login. ","crypto_random_status":"Met","crypto_random_justification":"In embedded environment,  there is a dependency on hardware entropy sources.  \r\nOur sample applications show how to leverage the drivers.  \r\n","delivery_mitm_status":"Met","delivery_mitm_justification":"Uses Git and hashes. Project pages https.","delivery_unsigned_status":"Met","vulnerabilities_fixed_60_days_status":"Met","vulnerabilities_fixed_60_days_justification":"https://docs.zephyrproject.org/latest/security/vulnerabilities.html","vulnerabilities_critical_fixed_status":"Met","vulnerabilities_critical_fixed_justification":"We have well documented survivability plan for the zephyr project and SDK. This will be part of the security working groups process.","static_analysis_status":"Met","static_analysis_justification":"We use Coverity tied to weekly builds. Security working group will determine future process that will include static analysis. ","static_analysis_common_vulnerabilities_status":"Met","static_analysis_common_vulnerabilities_justification":"Coverity (https://www.synopsys.com/software-integrity/security-testing/static-analysis-sast.html) is used for static code analysis.","static_analysis_fixed_status":"Met","static_analysis_fixed_justification":"They are logged as issues and resolved before release.","static_analysis_often_status":"Met","static_analysis_often_justification":"We don't do daily builds. Builds are completed on a weekly basis as part of CI, and run through coverity. ","dynamic_analysis_status":"Met","dynamic_analysis_justification":"GCOV and ASAN are used.","dynamic_analysis_unsafe_status":"N/A","dynamic_analysis_unsafe_justification":"Software is not application-level.","dynamic_analysis_enable_assertions_status":"Met","dynamic_analysis_enable_assertions_justification":"Assertions are enabled during test builds. There are \"many\" assertions in the code that are checked by this.","dynamic_analysis_fixed_status":"Met","dynamic_analysis_fixed_justification":"Software is not application-level. Any CVEs found via static code analysis or responsible disclosure channels are dealt with promptly. ","general_comments":"","created_at":"2016-03-10T17:42:23.962Z","updated_at":"2024-06-05T17:27:55.260Z","crypto_weaknesses_status":"Met","crypto_weaknesses_justification":"There are no default usages for weak crypto, SSH is not being used and is not supported.","test_continuous_integration_status":"Met","test_continuous_integration_justification":"https://github.com/zephyrproject-rtos/zephyr/actions/workflows/twister.yaml?query=branch%3Amain","cpe":"cpe:ZephyrProject","discussion_status":"Met","discussion_justification":"Have multiple channels of communication, GitHub, Discord, Mailing lists, etc.\r\nFor further details, see https://www.zephyrproject.org/community/#connect","no_leaked_credentials_status":"Met","no_leaked_credentials_justification":"The Zephyr Project does not distribute any credentials, but does work with MCUboot. The MCUboot bootloader is distributed with a small number of development keys that are checked into the project’s repository. The instructions (https://mcuboot.com/imgtool.html) in the project clearly state that these keys are only for development, and private keys used for production need to be protected.","english_status":"Met","english_justification":"https://github.com/zephyrproject-rtos/zephyr/issues","hardening_status":"Met","hardening_justification":"We do build by default with -Wformat -Wformat-security -Wno-format-zero-length and stack-protector is enabled as an option where supported. It is disabled by default for performance reasons but can be enabled by the user.  The master CMake file contents show this to be the case:\r\n\r\nhttps://github.com/zephyrproject-rtos/zephyr/blob/master/CMakeLists.txt","crypto_used_network_status":"Met","crypto_used_network_justification":"We support TLS and DTLS for all communication protocols. HTTPS, COAPS and any other protocols can be abled with additional security enabled.","crypto_tls12_status":"Met","crypto_tls12_justification":"All configurations of the project use TLS 12 by default:\r\n\r\nlib/crypto/mbedtls/configs/config-ccm-psk-tls1_2.h:#define MBEDTLS_SSL_PROTO_TLS1_2\r\next/lib/crypto/mbedtls/configs/config-coap.h:#define MBEDTLS_SSL_PROTO_TLS1_2\r\next/lib/crypto/mbedtls/configs/config-mini-dtls1_2.h:#define MBEDTLS_SSL_PROTO_TLS1_2\r\next/lib/crypto/mbedtls/configs/config-mini-tls1_2.h:#define MBEDTLS_SSL_PROTO_TLS1_2\r\next/lib/crypto/mbedtls/configs/config-threadnet.h:#define MBEDTLS_SSL_PROTO_TLS1_2\r\n\r\nhttps://github.com/zephyrproject-rtos/zephyr/tree/master/ext/lib/crypto/mbedtls/configs\r\n\r\n","crypto_certificate_verification_status":"Met","crypto_certificate_verification_justification":"The project contains a sample application that is located at the primary repository located at: https://github.com/zephyrproject-rtos/zephyr\r\nThe sample application implements a proper TLS secure connection and publishes data to the Google Cloud.","crypto_verification_private_status":"Met","crypto_verification_private_justification":"The project contains a sample application that is located at the primary repository located at: https://github.com/zephyrproject-rtos/zephyr\r\nThe sample application implements a proper TLS secure connection and publishes data to the Google Cloud.","hardened_site_status":"Met","hardened_site_justification":"The project websites implement hardening headers.\r\n\r\nwww.zephyrproject.org\r\nhttps://github.com/zephyrproject-rtos/zephyr // One or more of the required security hardening headers is missing. // X-Content-Type-Options was not set to \"nosniff\".","installation_common_status":"Met","installation_common_justification":"The build system provides a common method for installing on all target platforms.","build_reproducible_status":"Met","build_reproducible_justification":"Reproducible builds are guaranteed with an SDK provided by the project that given a commit or the same state of the source code would generate the same binaries and output files. Timestamps are not enabled by default and used only for debugging and testing. https://github.com/zephyrproject-rtos/zephyr/wiki/Repeatable-Builds-by-Architecture","badge_percentage_0":100,"achieved_passing_at":"2018-03-10T20:50:26.325Z","lost_passing_at":"2018-03-10T20:49:56.266Z","last_reminder_at":null,"disabled_reminders":false,"implementation_languages":"C, Python","lock_version":88,"badge_percentage_1":100,"dco_status":"Met","dco_justification":"DCO and signed-off-by expectations are documented in contribution guidelines: https://www.zephyrproject.org/doc/contribute/contribute_guidelines.html and in the GitHub CONTRIBUTING.rst file","governance_status":"Met","governance_justification":"https://www.zephyrproject.org/about/organization","code_of_conduct_status":"Met","code_of_conduct_justification":"Contributing and Conduct guidelines are found https://www.zephyrproject.org/community/community-guidelines\r\n","roles_responsibilities_status":"Met","roles_responsibilities_justification":"also documented at https://www.zephyrproject.org/about/organization","access_continuity_status":"Met","access_continuity_justification":"The project has distributed maintainer and codeowner roles, as found in the GitHub repository CODEOWNER files (https://github.com/zephyrproject-rtos/zephyr/blob/master/CODEOWNERS).  There are also multiple administrators for the GitHub site that are authorized to merge pull requests, and the development team is spread around the world (Canada, India, multiple US locations).","bus_factor_status":"Met","bus_factor_justification":"Using the truck-factor tool, we have a TF of 12, see https://github.com/zephyrproject-rtos/zephyr/wiki/Truck-Factor for the output from the tool.","documentation_roadmap_status":"Met","documentation_roadmap_justification":"The next 4 planned releases (1 year outlook) are shown here: https://github.com/zephyrproject-rtos/zephyr/projects/9","documentation_architecture_status":"Met","documentation_architecture_justification":"The Zephyr Kernel Primer (https://www.zephyrproject.org/doc/kernel/kernel.html) has an introduction to the kernel's key capabilities and services, along with an overview of the source tree structure.","documentation_security_status":"Met","documentation_security_justification":"https://www.zephyrproject.org/doc/security/security-overview.html outlines the steps of the Zephyr Security board towards a defined security process that helps developers build more secure software while addressing security compliance requirements","documentation_quick_start_status":"Met","documentation_quick_start_justification":"Getting Started guide is here: https://www.zephyrproject.org/doc/getting_started/getting_started.html","documentation_current_status":"Met","documentation_current_justification":"Documentation is maintained and released with each tagged release of the software (e.g., https://www.zephyrproject.org/doc/1.8.0/ for the 1.8 release).  Additionally, the master branch documentation is updated and maintained at https://www.zephyrproject.org/doc. Documentation defects are tracked along with code defects in our Jira (soon to be GitHub issues) system.","documentation_achievements_status":"Met","documentation_achievements_justification":"https://github.com/zephyrproject-rtos/zephyr has the cii best practices badge and the announcement page (https://www.zephyrproject.org/news/announcements) mentions project achievements. ","accessibility_best_practices_status":"N/A","accessibility_best_practices_justification":"Zephyr is an embedded OS without any user interface or textual output. This can come as part of an application on top of Zephyr, but zephyr itself does not have any end-user facing interface that needs to be internationalised.","internationalization_status":"N/A","internationalization_justification":"Zephyr is an embedded OS without any user interface or textual output. This can come as part of an application on top of Zephyr, but zephyr itself does not have any end-user facing interface that needs to be internationalised.","sites_password_security_status":"Met","sites_password_security_justification":"Website is not available for external users. Github and other services used do use a 2 factor authentication for all contributors.","maintenance_or_update_status":"Met","maintenance_or_update_justification":"Previous software releases are available from https://www.zephyrproject.org/downloads.  A plan for Long-Term-Support (LTS) support is in progress.","vulnerability_report_credit_status":"Met","vulnerability_report_credit_justification":"All changes to software are submitted through the GitHub pull request process and logged and reviewed there:  https://github.com/zephyrproject-rtos/zephyr/pulls.  Git log tools can be used to generate detailed reports, as well as summaries on  https://github.com/zephyrproject-rtos/zephyr/pulse for insights.","vulnerability_response_process_status":"Met","vulnerability_response_process_justification":"Security-related issue reporting is mentioned on https://www.zephyrproject.org/doc/introduction/introducing_zephyr.html and documented in  https://www.zephyrproject.org/doc/security/security-overview.html","coding_standards_status":"Met","coding_standards_justification":"The project contribution guidelines include coding standards and tools for verifying: https://www.zephyrproject.org/doc/contribute/contribute_guidelines.html#coding-style","coding_standards_enforced_status":"Met","coding_standards_enforced_justification":"gitlint and checkpatch tools automatically verify and enforce coding standards, as documented in https://www.zephyrproject.org/doc/contribute/contribute_guidelines.html#coding-style","build_standard_variables_status":"Met","build_standard_variables_justification":"We're using CMake to generate binaries which does support the above and does honor environment variables.","build_preserve_debug_status":"Met","build_preserve_debug_justification":"The generated ELF has debugging information, however the binary installed to the final platform may not preserve this information.","build_non_recursive_status":"Met","build_non_recursive_justification":"Any cross dependencies will cause a rebuild of the dependent component.","build_repeatable_status":"Met","build_repeatable_justification":"Rebuilding binaries that have no variable data such as timestamps results in the same bit-for-bit output, this is verified by building a binary for a certain configuration multiple times and comparing check-sums of generated binaries and all other output.","installation_standard_variables_status":"N/A","installation_standard_variables_justification":"We install the compiled image in a platform-specific way (e.g., to flash)","installation_development_quick_status":"Met","installation_development_quick_justification":"We have getting started guides for Linux, Windows, and MacOS","external_dependencies_status":"Met","external_dependencies_justification":"Note: this is about installation of items that are needed to use and build zephyr, see requirement above.\r\n\r\nExternal components are identified in the /ext area in GitHub:  https://github.com/zephyrproject-rtos/zephyr/tree/master/ext  but those are not \"installed\", they are part of the source. For external dependencies need to build and test the project we have scripts/requirements.txt (https://github.com/zephyrproject-rtos/zephyr/blob/master/scripts/requirements.txt).","dependency_monitoring_status":"Met","dependency_monitoring_justification":"see https://github.com/zephyrproject-rtos/zephyr/issues/6533, one step of the release process is to verify for known vulnerabilities","updateable_reused_components_status":"Met","updateable_reused_components_justification":"External components are self-contained without any modifications or local changes, we maintain information about the source and origin of such components and track the used versions and SHAs in case of git repositories. Updating to a new component is in most cases a drop-in replacement of existing code. We will support external components in external repos. Additional, wherever we have local modifications, we maintain a fork of the original trees and keep the trees up-to-date with upstream.\r\nLocal modification are submitted upstream where applicable, this is a policy of the project.","interfaces_current_status":"Met","interfaces_current_justification":"The project is self-contained and does use minimal external APIS, mostly from libc. We verify usage of those APIs on constant basis and remove any obsolete usage when found or reported.","automated_integration_testing_status":"Met","automated_integration_testing_justification":"Each commit/Pull Request requires passing a series of sanity checks, including building documentation, driven by the \"shippable\" tool: https://app.shippable.com/github/zephyrproject-rtos/zephyr/dashboard\r\n","regression_tests_added50_status":"Met","regression_tests_added50_justification":"Issues that are marked with regression label (https://github.com/zephyrproject-rtos/zephyr/labels/Regression) will be added to automated test-suite and integration tests that run through CI where applicable.","test_statement_coverage80_status":"Met","test_statement_coverage80_justification":"We use gcov/lcov to measure coverage of core features of the project. Due to the fact that Zephyr is an RTOS that can't be run with all features enabled on a host system, the coverage of some areas is not measured yet, the kernel however is being measured and has coverage of 80% in the supported configuration and where measurement is possible. Coverage reports can be found here: https://codecov.io/gh/zephyrproject-rtos/zephyr","test_policy_mandated_status":"Met","test_policy_mandated_justification":"Policy for adding new functionality and the requirements on tests can be seen here: https://github.com/zephyrproject-rtos/zephyr/blob/master/CONTRIBUTING.rst","implement_secure_design_status":"Met","implement_secure_design_justification":"http://docs.zephyrproject.org/security/secure-coding.html","input_validation_status":"N/A","input_validation_justification":"The project does not have user interfaces that would allow user input by default, so this is out of scope. If those interfaces are added by the developer/user they need to follow our secure coding practices document in the project here:  http://docs.zephyrproject.org/security/security.html","crypto_algorithm_agility_status":"Met","crypto_algorithm_agility_justification":"Through the support of mbedTLS and tinyCrypt, users and developers have  a variety of algorithms to choose from.","crypto_credential_agility_status":"N/A","crypto_credential_agility_justification":"This is application specific and is out of scope for the project. Mechanism to support this requirement are provided in general terms. Application developer will have to follow best practices for their use-case.","signed_releases_status":"Met","signed_releases_justification":"We don't do binary distributions and Git provides a secure release history.","version_tags_signed_status":"Met","version_tags_signed_justification":"Starting with release 1.12,  the releases are now being signed by keys of recognized developers \u0026 maintainers.","badge_percentage_2":100,"contributors_unassociated_status":"Met","contributors_unassociated_justification":"See the contributor list in github:\r\n\r\nhttps://github.com/zephyrproject-rtos/zephyr/graphs/contributors","copyright_per_file_status":"Met","copyright_per_file_justification":"All existing and future contributions will contain copyright holder and year.","license_per_file_status":"Met","license_per_file_justification":"All files contain a SPDX license statement.","small_tasks_status":"Met","small_tasks_justification":"\"good first issue\" label in GH issues:  https://github.com/zephyrproject-rtos/zephyr/labels/good%20first%20issue","require_2FA_status":"Met","require_2FA_justification":"Using Github 2FA and enforcing all contributors and members of the project to use this method of authentication.","secure_2FA_status":"Met","secure_2FA_justification":"Using Github 2FA and enforcing all contributors and members of the project to use this method of authentication.This method relies on google authenticator which is time based TOTP","code_review_standards_status":"Met","code_review_standards_justification":"https://github.com/zephyrproject-rtos/zephyr/blob/master/CONTRIBUTING.rst","two_person_review_status":"Met","two_person_review_justification":"GH pull requests do not allow the original author to merge their own changes.","test_statement_coverage90_status":"Met","test_statement_coverage90_justification":"https://codecov.io/gh/zephyrproject-rtos/zephyr","test_branch_coverage80_status":"Met","test_branch_coverage80_justification":"https://codecov.io/gh/zephyrproject-rtos/zephyr","security_review_status":"Met","security_review_justification":"This was done in 2017 and performed by David Brown and most recently\r\nhttps://research.nccgroup.com/wp-content/uploads/2020/05/NCC_Group_Zephyr_MCUboot_Research_Report_2020-05-26_v1.0.pdf","assurance_case_status":"Met","assurance_case_justification":"The project maintains documentation of current threat models, identification of assets, and trust boundaries.  The documentation also provides coding and development guidelines intended to mitigate threats.\r\n\r\nSee: https://docs.zephyrproject.org/latest/security/secure-coding.html","achieve_passing_status":"Met","achieve_silver_status":"Met","tiered_percentage":300,"repo_url_updated_at":null,"achieved_silver_at":null,"lost_silver_at":null,"achieved_gold_at":"2023-10-16T17:02:29.235Z","lost_gold_at":"2023-10-16T04:48:57.032Z","first_achieved_passing_at":"2018-03-10T20:50:26.325Z","first_achieved_silver_at":null,"first_achieved_gold_at":"2023-10-16T17:02:29.235Z","maintained_status":"Met","OSPS-AC-01.01_status":"?","OSPS-AC-02.01_status":"?","OSPS-AC-03.01_status":"?","OSPS-AC-03.02_status":"?","OSPS-BR-01.01_status":"?","OSPS-BR-01.02_status":0,"OSPS-BR-01.02_justification":null,"OSPS-BR-03.01_status":"?","OSPS-BR-03.02_status":"?","OSPS-BR-07.01_status":"?","OSPS-DO-01.01_status":"?","OSPS-DO-02.01_status":"?","OSPS-GV-02.01_status":"?","OSPS-GV-03.01_status":"?","OSPS-LE-02.01_status":"?","OSPS-LE-02.02_status":"?","OSPS-LE-03.01_status":"?","OSPS-LE-03.02_status":"?","OSPS-QA-01.01_status":"?","OSPS-QA-01.02_status":"?","OSPS-QA-02.01_status":"?","OSPS-QA-04.01_status":"?","OSPS-QA-05.01_status":"?","OSPS-QA-05.02_status":"?","OSPS-VM-02.01_status":"?","OSPS-AC-04.01_status":"?","OSPS-BR-02.01_status":"?","OSPS-BR-04.01_status":"?","OSPS-BR-05.01_status":"?","OSPS-BR-06.01_status":"?","OSPS-DO-06.01_status":"?","OSPS-GV-01.01_status":"?","OSPS-GV-01.02_status":"?","OSPS-GV-03.02_status":"?","OSPS-LE-01.01_status":"?","OSPS-QA-03.01_status":"?","OSPS-QA-06.01_status":"?","OSPS-SA-01.01_status":"?","OSPS-SA-02.01_status":"?","OSPS-SA-03.01_status":"?","OSPS-VM-01.01_status":"?","OSPS-VM-03.01_status":"?","OSPS-VM-04.01_status":"?","OSPS-AC-04.02_status":"?","OSPS-BR-02.02_status":"?","OSPS-BR-07.02_status":"?","OSPS-DO-03.01_status":"?","OSPS-DO-03.02_status":"?","OSPS-DO-04.01_status":"?","OSPS-DO-05.01_status":"?","OSPS-GV-04.01_status":"?","OSPS-QA-02.02_status":"?","OSPS-QA-04.02_status":"?","OSPS-QA-06.02_status":"?","OSPS-QA-06.03_status":"?","OSPS-QA-07.01_status":"?","OSPS-SA-03.02_status":"?","OSPS-VM-04.02_status":"?","OSPS-VM-05.01_status":"?","OSPS-VM-05.02_status":"?","OSPS-VM-05.03_status":"?","OSPS-VM-06.01_status":"?","OSPS-VM-06.02_status":"?","badge_percentage_baseline_1":0,"badge_percentage_baseline_2":0,"badge_percentage_baseline_3":0,"achieved_baseline_1_at":null,"achieved_baseline_2_at":null,"achieved_baseline_3_at":null,"lost_baseline_1_at":null,"lost_baseline_2_at":null,"lost_baseline_3_at":null,"first_achieved_baseline_1_at":null,"first_achieved_baseline_2_at":null,"first_achieved_baseline_3_at":null,"baseline_tiered_percentage":0,"entry_locale":"en","passing_saved":true,"silver_saved":true,"gold_saved":true,"baseline_1_saved":false,"baseline_2_saved":false,"baseline_3_saved":false,"OSPS-BR-01.03_status":"?","OSPS-DO-07.01_status":"?","OSPS-BR-01.04_status":"?","unreported_badge_loss":0,"unreported_baseline_badge_loss":0,"last_loss_sent_at":null,"unreported_badge_warning":0,"unreported_baseline_badge_warning":0,"last_warning_sent_at":null,"badge_warning_effective_date":null,"badge_level":"gold","additional_rights":[1548,2234,2235,5121,10009],"project_entry_attribution":"Please credit Brett Preston and the CII Best Practices badge contributors.","project_entry_license":"CC-BY-3.0+"}]