t3x-nr-vault

Projects that follow the best practices below can voluntarily self-certify and show that they've achieved an Open Source Security Foundation (OpenSSF) best practices badge.

There is no set of practices that can guarantee that software will never have defects or vulnerabilities; even formal methods can fail if the specifications or assumptions are wrong. Nor is there any set of practices that can guarantee that a project will sustain a healthy and well-functioning development community. However, following best practices can help improve the results of projects. For example, some practices enable multi-person review before release, which can both help find otherwise hard-to-find technical vulnerabilities and help build trust and a desire for repeated interaction among developers from different companies. To earn a badge, all MUST and MUST NOT criteria must be met, all SHOULD criteria must be met OR be unmet with justification, and all SUGGESTED criteria must be met OR unmet (we want them considered at least). If you want to enter justification text as a generic comment, instead of being a rationale that the situation is acceptable, start the text block with '//' followed by a space. Feedback is welcome via the GitHub site as issues or pull requests There is also a mailing list for general discussion.

We gladly provide the information in several locales, however, if there is any conflict or inconsistency between the translations, the English version is the authoritative version.
If this is your project, please show your badge status on your project page! The badge status looks like this: Badge level for project 11695 is in_progress Here is how to embed it:
You can show your badge status by embedding this in your markdown file:
[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/11695/badge)](https://www.bestpractices.dev/projects/11695)
or by embedding this in your HTML:
<a href="https://www.bestpractices.dev/projects/11695"><img src="https://www.bestpractices.dev/projects/11695/badge"></a>


These are the Gold level criteria. You can also view the Passing or Silver level criteria.

Baseline Series: Baseline Level 1 Baseline Level 2 Baseline Level 3

        

 Basics 1/5 ●

  • General

    Note that other projects may use the same name.

    Secure secrets management for TYPO3 with envelope encryption, access control, and audit logging

    Please use SPDX license expression format; examples include "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "GPL-2.0+", "LGPL-3.0+", "MIT", and "(BSD-2-Clause OR Ruby)". Do not include single quotes or double quotes.
    If there is more than one language, list them as comma-separated values (spaces optional) and sort them from most to least used. If there is a long list, please list at least the first three most common ones. If there is no language (e.g., this is a documentation-only or test-only project), use the single character "-". Please use a conventional capitalization for each language, e.g., "JavaScript".
    The Common Platform Enumeration (CPE) is a structured naming scheme for information technology systems, software, and packages. It is used in a number of systems and databases when reporting vulnerabilities.

  • Prerequisites


    Not enough for a badge.

    The project MUST achieve a silver level badge. [achieve_silver]

    Silver requirements are not all met in this self-assessment, so a silver badge is not currently claimed. The badge service calculates the achievement from the saved answers. Evidence: https://www.bestpractices.dev/en/projects/11695


  • Project oversight


    Enough for a badge!

    The project MUST have a "bus factor" of 2 or more. (URL required) [bus_factor]
    A "bus factor" (aka "truck factor") is the minimum number of project members that have to suddenly disappear from a project ("hit by a bus") before the project stalls due to lack of knowledgeable or competent personnel. The truck-factor tool can estimate this for projects on GitHub. For more information, see Assessing the Bus Factor of Git Repositories by Cosentino et al.

    Retained the project maintainer's existing attestation that multiple team members can continue this project; organization ownership/backup access and documented development procedures remain in place. This is an attributed maintainer assessment, not a conclusion drawn from commit counts alone. Evidence: https://www.bestpractices.dev/en/projects/11695 https://github.com/netresearch/t3x-nr-vault/blob/8bbc6c5b7f50c5314c5f85ae6bba2f145de94f67/CONTRIBUTING.md https://github.com/orgs/netresearch/people


    Not enough for a badge.

    The project MUST have at least two unassociated significant contributors. (URL required) [contributors_unassociated]
    Contributors are associated if they are paid to work by the same organization (as an employee or contractor) and the organization stands to benefit from the project's results. Financial grants do not count as being from the same organization if they pass through other organizations (e.g., science grants paid to different organizations from a common government or NGO source do not cause contributors to be associated). Someone is a significant contributor if they have made non-trivial contributions to the project in the past year. Examples of good indicators of a significant contributor are: written at least 1,000 lines of code, contributed 50 commits, or contributed at least 20 pages of documentation.

    The existing maintainer assessment states that current significant contributors are associated with Netresearch and that two significant financially unassociated contributors have not yet been established. No current evidence contradicts that disclosure. Evidence: https://www.bestpractices.dev/en/projects/11695 https://github.com/netresearch/t3x-nr-vault/graphs/contributors


  • Other


    Not enough for a badge.

    The project MUST include a license statement in each source file. This MAY be done by including the following inside a comment near the beginning of each file: SPDX-License-Identifier: [SPDX license expression for project]. [license_per_file]
    This MAY also be done by including a statement in natural language identifying the license. The project MAY also include a stable URL pointing to the license text, or the full license text. Note that the criterion license_location requires the project license be in a standard location. See this SPDX tutorial for more information about SPDX license expressions. Note the relationship with copyright_per_file, whose content would typically precede the license information.

    Not every project source file identifies its license; for example Build/Scripts/check-msi.sh. A repository-level license or an author URL alone does not satisfy per-file licensing. Evidence: https://github.com/netresearch/t3x-nr-vault/blob/8bbc6c5b7f50c5314c5f85ae6bba2f145de94f67/Build/Scripts/check-msi.sh


 Change Control 2/4 ●

  • Public version-controlled source repository


    Enough for a badge!

    The project's source repository MUST use a common distributed version control software (e.g., git or mercurial). [repo_distributed]
    Git is not specifically required and projects can use centralized version control software (such as subversion) with justification.

    The public Git repository records intermediate commits, authors, timestamps, and changes. Current inspected revision is 8bbc6c5b7f50c5314c5f85ae6bba2f145de94f67. Evidence: https://github.com/netresearch/t3x-nr-vault https://github.com/netresearch/t3x-nr-vault/commits/main


    Unknown required information, not enough for a badge.

    The project MUST clearly identify small tasks that can be performed by new or casual contributors. (URL required) [small_tasks]
    This identification is typically done by marking selected issues in an issue tracker with one or more tags the project uses for the purpose, e.g., up-for-grabs, first-timers-only, "Small fix", microtask, or IdealFirstBug. These new tasks need not involve adding functionality; they can be improving documentation, adding test cases, or anything else that aids the project and helps the contributor understand more about the project.

    Contributor instructions mention introductory tasks, but no current actionable issue set explicitly marked for new/casual contributors was verified. Evidence: https://github.com/netresearch/t3x-nr-vault/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22


    Enough for a badge!

    The project MUST require two-factor authentication (2FA) for developers for changing a central repository or accessing sensitive data (such as private vulnerability reports). This 2FA mechanism MAY use mechanisms without cryptographic mechanisms such as SMS, though that is not recommended. [require_2FA]

    Authenticated GitHub organization metadata confirms two_factor_requirement_enabled=true for netresearch; GitHub enforces organization MFA for repository members/collaborators. This asserts the repository requirement, not that every member uses a specific factor type. Evidence: https://github.com/organizations/netresearch/settings/security https://api.github.com/orgs/netresearch


    Unknown required information, not enough for a badge.

    The project's two-factor authentication (2FA) SHOULD use cryptographic mechanisms to prevent impersonation. Short Message Service (SMS) based 2FA, by itself, does NOT meet this criterion, since it is not encrypted. [secure_2FA]
    A 2FA mechanism that meets this criterion would be a Time-based One-Time Password (TOTP) application that automatically generates an authentication code that changes after a certain period of time. Note that GitHub supports TOTP.

    Organization MFA enforcement is verified, but actual cryptographic second-factor usage is not disclosed. GitHub supporting passkeys/TOTP does not prove members use them instead of SMS. Evidence: https://github.com/netresearch/t3x-nr-vault


 Quality 5/7 ●

 Security 4/5 ●

 Analysis 1/2 ●


You can use tools and AI systems to propose changes via a simple URL, such as https://www.bestpractices.dev/en/projects/11695/choose/edit?osps_ac_01_01_status=Met&osps_ac_01_01_justification=GitHub+enforced. See our automation proposals system for how to do that. This data is available under the Community Data License Agreement – Permissive, Version 2.0 (CDLA-Permissive-2.0). This means that a Data Recipient may share the Data, with or without modifications, so long as the Data Recipient makes available the text of this agreement with the shared Data. Please credit Sebastian Mendel and the OpenSSF Best Practices badge contributors.

Project badge entry owned by: Sebastian Mendel.
Entry created on 2026-01-05 21:59:04 UTC, last updated on 2026-09-29 15:18:29 UTC. Last lost passing badge on 2026-09-29 15:18:29 UTC. Last achieved passing badge on 2026-01-05 22:18:22 UTC.