t3x-nr-llm

Miradi inayofuata mazoea bora hapa chini inaweza kujihakikisha kwa hiari na kuonyesha kuwa wamepata nishani ya mazoea bora ya Open Source Security Foundation (OpenSSF).

Hakuna seti ya mazoea yawezayo kuhakikisha kuwa programu haitakuwa na kasoro au udhaifu; hata mbinu rasmi zinaweza kushindwa ikiwa vipimo au dhana ni sahihi. Wala hakuna seti ya mazoea yawezayo kuhakikisha kuwa mradi utaendelea kuwa na jamii ya maendeleo yenye afya na inayofanya kazi vizuri. Hata hivyo, kufuata mazoea bora kunaweza kusaidia kuboresha matokeo ya miradi. Kwa mfano, baadhi ya mazoea huwezesha ukaguzi wa watu wengi kabla ya kutolewa, ambayo inaweza kusaidia kupata udhaifu wa kiufundi ambao vinginevyo ni vigumu kupata na kusaidia kujenga uaminifu na hamu ya mwingiliano wa kurudia kati ya wasanidi programu kutoka makampuni tofauti. Ili kupata nishani, vigezo vyote vya LAZIMA na LAZIMA WALA USIWAHI lazima vifuatwe, vigezo vyote vya INAPASWA lazima vifuatwe AU visivyo fufufutiliana na thibitisho, na vigezo vyote vya PENDEKEZA lazima vifuatwe AU visivyo fufufutiliana (tunataka vifikiwe angalau). Ikiwa unataka kuingiza maandishi ya thibitisho kama maoni ya jumla, badala ya kuwa maelezo ya busara kwamba hali ni inakubaliwa, anza kifungu cha maandishi na '//' ikifuatiwa na nafasi. Maoni ni karibu kupitia tovuti ya GitHub kama masuala au maombi ya kuvuta Kuna pia orodha ya barua pepe kwa majadiliano ya jumla.

Tunafuraha kutoa habari katika lugha nyingi, hata hivyo, ikiwa kuna mgongano au kutokuwa na usawa kati ya tafsiri, toleo la Kiingereza ni toleo lenye mamlaka.
Ikiwa huu ni mradi wako, tafadhali onyesha hadhi ya nishani yako kwenye ukurasa wa mradi wako! Hadhi ya nishani inaonekana kama hii: Kiwango cha nishani kwa mradi 11697 ni in_progress Hapa ni jinsi ya kuiweka:
Unaweza kuonyesha hali ya nishani yako kwa kuweka hii katika faili yako ya markdown:
[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/11697/badge)](https://www.bestpractices.dev/projects/11697)
au kwa kuweka hii katika HTML yako:
<a href="https://www.bestpractices.dev/projects/11697"><img src="https://www.bestpractices.dev/projects/11697/badge"></a>


Hizi ni vigezo vya kiwango cha Dhahabu. Unaweza pia kuangalia vigezo vya kiwango cha Kupita au Fedha.

Baseline Series: Kiwango cha Msingi 1 Kiwango cha Msingi 2 Kiwango cha Msingi 3

        

 Misingi 0/5 ●

  • Jumla

    Kumbuka kwamba miradi mingine inaweza kutumia jina sawa.

    The shared AI foundation for TYPO3 — one LLM setup for every extension on your site

    Tafadhali tumia muundo wa maneno ya leseni ya SPDX; mifano ni pamoja na "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "GPL-2.0+", "LGPL-3.0+", "MIT", na "(BSD-2-Clause OR Ruby)". Usitumie alama za nukuu za moja au mbili.
    Ikiwa kuna lugha zaidi ya moja, ziorodhe kama thamani zilizotengwa kwa koma (nafasi ni za hiari) na ziorodhe kuanzia iliyotumiwa zaidi hadi iliyotumiwa kidogo. Ikiwa kuna orodha ndefu, tafadhali orodhesha angalau tatu za kawaida zaidi. Ikiwa hakuna lugha (k.m., huu ni mradi wa nyaraka tu au wa majaribio tu), tumia herufi moja "-". Tafadhali tumia herufi kubwa za kawaida kwa kila lugha, k.m., "JavaScript".
    Common Platform Enumeration (CPE) ni mpango wa kuweka majina yenye muundo kwa mifumo ya teknolojia ya habari, programu, na vifurushi. Inatumika katika mifumo na hifadhidata nyingi wakati wa kuripoti udhaifu.

  • Mahitaji ya awali


    Si ya kutosha kwa nishani.

    Mradi LAZIMA ufikie kiwango cha nishani ya fedha. [achieve_silver]

    Silver requirements are not all met in this self-assessment, so a silver badge is not currently claimed. The badge service calculates the achievement from the saved answers. Evidence: https://www.bestpractices.dev/en/projects/11697


  • Usimamizi wa mradi


    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi LAZIMA uwe na "bus factor" ya 2 au zaidi. (URL inahitajika) [bus_factor]
    "Bus factor" (pia inajulikana kama "truck factor") ni idadi ya chini ya washiriki wa mradi ambao wanapaswa kutoweka ghafla kutoka kwenye mradi ("kupigwa na basi") kabla ya mradi kusimama kwa sababu ya ukosefu wa wafanyakazi wenye elimu au wenye uwezo. Zana ya truck-factor inaweza kukadiria hii kwa miradi kwenye GitHub. Kwa maelezo zaidi, angalia Kutathmini Bus Factor ya Hifadhi za Git na Cosentino et al.

    A bus factor of at least two has not been established by the available evidence. Organization-level backup access addresses access continuity but does not by itself establish that a second person has sufficient project knowledge to sustain maintenance. The current project document describes a solo-maintainer model. The former Dependabot reviewer assignment is no longer evidence because .github/dependabot.yml was removed. This answer does not infer personnel competence from commit counts. See https://github.com/netresearch/t3x-nr-llm/blob/21d17f3a29d6b99192535876376dc3e1d6bdc1b3/.github/SECURITY_CONTROLS.md#succession-planning and https://github.com/netresearch/t3x-nr-llm/pull/939. Current repository self-assessment: https://github.com/netresearch/t3x-nr-llm/blob/31fb1ef86a00a5071b132f5faefc686a3accf08f/.bestpractices.json


    Si ya kutosha kwa nishani.

    Mradi LAZIMA uwe na angalau wachangiaji wawili wasiohusika. (URL inahitajika) [contributors_unassociated]
    Wachangiaji wanahusianishwa ikiwa wanalipwa kufanya kazi na shirika moja (kama mwajiriwa au mkandarasi) na shirika lile linapata faida kutokana na matokeo ya mradi. Misaada ya kifedha haihesabiwi kuwa kutoka shirika sawa ikiwa inapitia mashirika mengine (k.m., misaada ya sayansi inayolipwa kwa mashirika tofauti kutoka serikali ya kawaida au chanzo cha NGO haifanyi wachangiaji kuhusianishwa). Mtu ni mchangiaji muhimu ikiwa amefanya michango isiyojulikana kwa mradi katika mwaka uliopita. Mifano ya viashiria vizuri vya mchangiaji muhimu ni: ameandika angalau mistari 1,000 ya msimbo, amechangia commits 50, au amechangia angalau kurasa 20 za nyaraka.

    The existing maintainer assessment states that current significant contributors are associated with Netresearch and that two significant financially unassociated contributors have not yet been established. No current evidence contradicts that disclosure. Evidence: https://www.bestpractices.dev/en/projects/11697 https://github.com/netresearch/t3x-nr-llm/graphs/contributors


  • Mengine


    Si ya kutosha kwa nishani.

    Mradi LAZIMA ujumuishe tamko la leseni katika kila faili ya chanzo. Hii YAWEZA kufanyika kwa kujumuisha yafuatayo ndani ya maoni karibu na mwanzo wa kila faili: SPDX-License-Identifier: [maneno ya leseni ya SPDX kwa mradi]. [license_per_file]
    Hii pia YAWEZA kufanyika kwa kujumuisha tamko katika lugha asilia ikitambulisha leseni. Mradi pia YAWEZA kujumuisha URL thabiti inayoelekeza kwenye maandishi ya leseni, au maandishi kamili ya leseni. Kumbuka kwamba kigezo cha license_location kinahitaji leseni ya mradi iwe mahali pa kawaida. Angalia mafunzo haya ya SPDX kwa maelezo zaidi kuhusu maneno ya leseni ya SPDX. Kumbuka uhusiano na copyright_per_file, ambayo yaliyomo yake kwa kawaida yangetangulia maelezo ya leseni.

    Not every project source file identifies its license; for example Build/Scripts/check-roadmap-issue-state.sh. A repository-level license or an author URL alone does not satisfy per-file licensing. Evidence: https://github.com/netresearch/t3x-nr-llm/blob/31fb1ef86a00a5071b132f5faefc686a3accf08f/Build/Scripts/check-roadmap-issue-state.sh


 Udhibiti wa Mabadiliko 2/4 ●

  • Hifadhi ya chanzo ya kudhibiti toleo ya hadharani


    Ya kutosha kwa nishani!

    Hifadhi ya chanzo ya mradi LAZIMA itumie programu ya kawaida ya kudhibiti toleo linalosambazwa (k.m., git au mercurial). [repo_distributed]
    Git haihitajiki kihususa na miradi inaweza kutumia programu ya udhibiti wa toleo iliyokusanyika (kama subversion) na sababu.

    The public Git repository records intermediate commits, authors, timestamps, and changes. Current inspected revision is 31fb1ef86a00a5071b132f5faefc686a3accf08f. Evidence: https://github.com/netresearch/t3x-nr-llm https://github.com/netresearch/t3x-nr-llm/commits/main


    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi LAZIMA utambulishe kazi ndogo ambazo zinaweza kufanywa na wachangiaji wapya au wa mara kwa mara. (URL inahitajika) [small_tasks]
    Utambulisho huu kwa kawaida unafanyika kwa kuweka alama masuala yaliyochaguliwa katika kifuatiliaji cha masuala kwa lebo moja au zaidi ambazo mradi unatumia kwa madhumuni hayo, k.m., up-for-grabs, first-timers-only, "Marekebisho madogo", microtask, au IdealFirstBug. Kazi hizi mpya hazihitaji kujumuisha kuongeza utendaji; zinaweza kuwa kuboresha nyaraka, kuongeza hali za majaribio, au chochote kingine kinachosaidia mradi na kusaidia mchangiaji kuelewa zaidi kuhusu mradi.

    Contributor instructions mention introductory tasks, but no current actionable issue set explicitly marked for new/casual contributors was verified. Evidence: https://github.com/netresearch/t3x-nr-llm/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22


    Ya kutosha kwa nishani!

    Mradi LAZIMA uhitaji uthibitishaji wa mambo mawili (2FA) kwa wasanidi programu ili kubadilisha hifadhi ya kati au kupata data nyeti (kama ripoti za faragha za udhaifu). Utaratibu huu wa 2FA YAWEZA kutumia taratibu bila taratibu za usimbuaji kama SMS, ingawa hii hairuhusiwi. [require_2FA]

    Authenticated GitHub organization metadata confirms two_factor_requirement_enabled=true for netresearch; GitHub enforces organization MFA for repository members/collaborators. This asserts the repository requirement, not that every member uses a specific factor type. Evidence: https://github.com/organizations/netresearch/settings/security https://api.github.com/orgs/netresearch


    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Uthibitishaji wa mambo mawili (2FA) ya mradi INAPASWA kutumia taratibu za usimbuaji ili kuzuia ujigeuzi. Uthibitishaji wa 2FA unaotegemea Huduma ya Ujumbe Mfupi (SMS), peke yake, HAUKIDHI kigezo hiki, kwa kuwa haufichui. [secure_2FA]
    Utaratibu wa 2FA unaokidhi kigezo hiki unaweza kuwa programu ya Nywila ya Mara Moja Inayotegemea Muda (TOTP) ambayo inazalisha kiotomatiki msimbo wa uthibitishaji unaobadilika baada ya muda fulani. Kumbuka kwamba GitHub inasaidia TOTP.

    Organization MFA enforcement is verified, but actual cryptographic second-factor usage is not disclosed. GitHub supporting passkeys/TOTP does not prove members use them instead of SMS. Evidence: https://github.com/netresearch/t3x-nr-llm


 Ubora 4/7 ●

 Usalama 4/5 ●

  • Tumia mazoea mazuri ya msingi ya usimbuaji

    Kumbuka kwamba programu fulani haihitaji kutumia taratibu za usimbuaji. Ikiwa mradi wako unazalisha programu ambayo (1) inajumuisha, inaamilisha, au inafanya usimbuaji kuwa hai, na (2) inaweza kutolewa kutoka Marekani (US) kwenda nje ya Marekani au kwa raia asiye wa Marekani, inaweza kuwa ni lazima kisheria kuchukua hatua chache za ziada. Kawaida hii inahusisha tu kutuma barua pepe. Kwa maelezo zaidi, tazama sehemu ya usimbuaji ya Kuelewa Teknolojia ya Chanzo Wazi & Udhibiti wa Usafirishaji wa Marekani.

    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Programu iliyozalishwa na mradi LAZIMA isaidie itifaki salama kwa mawasiliano yake yote ya mtandao, kama vile SSHv2 au zaidi, TLS1.2 au zaidi (HTTPS), IPsec, SFTP, na SNMPv3. Itifaki zisizo salama kama vile FTP, HTTP, telnet, SSLv3 au mapema zaidi, na SSHv1 LAZIMA zizimwe kwa chaguo-msingi, na kuzimwa tu ikiwa mtumiaji anaisanidi mahususi. Ikiwa programu iliyozalishwa na mradi haiesaidii mawasiliano ya mtandao, chagua "haihusiki" (N/A). [crypto_used_network]

    No complete transport inventory establishes that every network path uses secure protocols by default and enables insecure protocols only by explicit configuration. Evidence: https://github.com/netresearch/t3x-nr-llm


    Ya kutosha kwa nishani!

    Programu iliyozalishwa na mradi LAZIMA, ikiwa inasaidia au inatumia TLS, isaidie angalau toleo la TLS 1.2. Kumbuka kwamba kabla ya TLS kuitwa SSL. Ikiwa programu haitumii TLS, chagua "haihusiki" (N/A). [crypto_tls12]

    The supported PHP/TYPO3/Guzzle runtime supports TLS 1.2 or newer. This criterion asks for TLS-version support; it does not require proving which version every operator-configured connection negotiates. Evidence: https://github.com/netresearch/t3x-nr-llm/blob/31fb1ef86a00a5071b132f5faefc686a3accf08f/composer.json https://docs.guzzlephp.org/en/stable/request-options.html#ssl-key


  • Utoaji salama dhidi ya mashambulizi ya mtu-katikati (MITM)


    Ya kutosha kwa nishani!

    Tovuti ya mradi, hifadhi (ikiwa inapatikana kupitia wavuti), na tovuti ya kupakua (ikiwa ni tofauti) LAZIMA ijumuishe vichwa muhimu vya kuimarisha na thamani zisizo na ruhusa. (URL inahitajika) [hardened_site]
    Kumbuka kwamba GitHub na GitLab zinajulikana kukidhi hii. Tovuti kama vile https://securityheaders.com/ zinaweza kuangalia hii haraka. Vichwa muhimu vya kuimarisha ni: Sera ya Usalama wa Maudhui (CSP), Usalama wa Usafiri wa HTTP Mkali (HSTS), X-Content-Type-Options (kama "nosniff"), na X-Frame-Options. Tovuti za wavuti zilizo za tuli kabisa bila uwezo wa kuingia kupitia kurasa za wavuti zinaweza kuacha baadhi ya vichwa vya kuimarisha na hatari ndogo, lakini hakuna njia ya kuaminika ya kugundua tovuti kama hizo, kwa hivyo tunahitaji vichwa hivi hata kama ni tovuti za tuli kabisa.

    The authoritative project web, repository and download services use GitHub/GitHub Pages HTTPS hosting. The criterion explicitly recognizes GitHub hosting as satisfying its site-hardening requirement. Evidence: https://github.com/netresearch/t3x-nr-llm https://netresearch.github.io/t3x-nr-llm/


  • Masuala mengine ya usalama


    Ya kutosha kwa nishani!

    Mradi LAZIMA uwe umefanya ukaguzi wa usalama ndani ya miaka 5 iliyopita. Ukaguzi huu LAZIMA uzingatie mahitaji ya usalama na mpaka wa usalama. [security_review]
    Hii YAWEZA kufanywa na wanachama wa mradi na/au tathmini huru. Tathmini hii YAWEZA kusaidiwa na zana za uchambuzi za tuli na zenye nguvu, lakini lazima pia kuwe na ukaguzi wa binadamu ili kutambua matatizo (hasa katika muundo) ambayo zana haziwezi kugundua.

    The project records an internal security review dated 2026-01-05, within the five-year criterion window. The archived report lists manual review of authentication, authorization, API-key handling, input validation, errors/logging and sensitive data, alongside automated analysis. It is explicitly historical and does not describe the current shipped extension. SECURITY_AUDIT.md also documents scoped reviews on 2026-07-19 and links their fixes; it states that no current full-scope audit exists. This answer relies on the documented internal review, not independent certification or a current claim of zero vulnerabilities. See https://github.com/netresearch/t3x-nr-llm/blob/main/Audits/2026-01-05-internal-self-audit.md and https://github.com/netresearch/t3x-nr-llm/blob/main/SECURITY_AUDIT.md. Evidence: https://github.com/netresearch/t3x-nr-llm/blob/31fb1ef86a00a5071b132f5faefc686a3accf08f/.bestpractices.json


    Ya kutosha kwa nishani!

    Taratibu za kuimarisha LAZIMA zitumike katika programu iliyozalishwa na mradi ili kasoro za programu ziwe na uwezekano mdogo wa kusababisha udhaifu wa usalama. (URL inahitajika) [hardening]
    Taratibu za kuimarisha zinaweza kujumuisha vichwa vya HTTP kama Sera ya Usalama wa Maudhui (CSP), bendera za mkusanyaji ili kupunguza mashambulizi (kama vile -fstack-protector), au bendera za mkusanyaji ili kuondoa tabia isiyofafanuliwa. Kwa madhumuni yetu upendeleo mdogo hauhesabiwi kuwa utaratibu wa kuimarisha (upendeleo mdogo ni muhimu, lakini tofauti).

    The runtime contains secret redaction, SensitiveParameter annotations, zeroization of key copies, and execution-boundary safeguards documented in the security assurance argument. These reduce the impact of accidental disclosure and unsafe execution beyond CI-only protections. Evidence: https://github.com/netresearch/t3x-nr-llm/blob/31fb1ef86a00a5071b132f5faefc686a3accf08f/SECURITY_AUDIT.md https://github.com/netresearch/t3x-nr-llm/blob/31fb1ef86a00a5071b132f5faefc686a3accf08f/Classes/Specialized/Translation/DeepLTranslator.php https://github.com/netresearch/t3x-nr-llm/tree/31fb1ef86a00a5071b132f5faefc686a3accf08f/Classes/


 Uchanganuzi 1/2 ●

  • Uchambuzi wa msimbo wa nguvu za ziada


    Ya kutosha kwa nishani!

    Mradi LAZIMA utumie angalau zana moja ya uchambuzi wenye nguvu kwa toleo lolote lililopendekezwa kuu la uzalishaji wa programu iliyozalishwa na mradi kabla ya kutolewa kwake. [dynamic_analysis]
    Zana ya uchambuzi wa nguvu inachunguza programu kwa kuitekeleza na ingizo maalum. Kwa mfano, mradi YAWEZA kutumia zana ya fuzzing (k.m., American Fuzzy Lop) au kitafutaji cha programu ya wavuti (k.m., OWASP ZAP au w3af). Katika hali fulani mradi wa OSS-Fuzz unaweza kuwa tayari kutumia majaribio ya fuzz kwenye mradi wako. Kwa madhumuni ya kigezo hiki zana ya uchambuzi wa nguvu inahitaji kubadilisha ingizo kwa njia fulani kutafuta aina mbalimbali za matatizo au kuwa seti kiotomatiki ya majaribio yenye angalau asilimia 80 ya ukaguzi wa tawi. Ukurasa wa Wikipedia kuhusu uchambuzi wa nguvu na ukurasa wa OWASP kuhusu fuzzing hutambulisha baadhi ya zana za uchambuzi wa nguvu. Zana za uchambuzi ZINAWEZA kuzingatia kutafuta udhaifu wa usalama, lakini hii haihitajiki.

    Dynamic testing includes TYPO3 functional tests, browser E2E tests and property-based tests. Infection mutation testing runs on the weekly CI schedule and is explicitly report-only at present. These are the documented runtime-testing mechanisms; this does not claim comprehensive fuzzing or universal vulnerability detection. See https://github.com/netresearch/t3x-nr-llm/blob/main/.github/workflows/ci.yml and https://github.com/netresearch/t3x-nr-llm/blob/main/.github/workflows/e2e.yml. Evidence: https://github.com/netresearch/t3x-nr-llm/blob/31fb1ef86a00a5071b132f5faefc686a3accf08f/.bestpractices.json


    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi INAPASWA kujumuisha madai mengi ya muda wa kutekeleza katika programu inayozalisha na kuangalia madai hayo wakati wa uchambuzi wenye nguvu. [dynamic_analysis_enable_assertions]
    Kigezo hiki hakipendekezi kuwezesha madai wakati wa uzalishaji; hilo ni kabisa kwa mradi na watumiaji wake kuamua. Lengo la kigezo hiki ni badala yake kuboresha ugunduzaji wa hitilafu wakati wa uchambuzi wa nguvu kabla ya kusambazwa. Kuwezesha madai katika matumizi ya uzalishaji ni tofauti kabisa na kuwezesha madai wakati wa uchambuzi wa nguvu (kama vile majaribio). Katika hali fulani kuwezesha madai katika matumizi ya uzalishaji ni busara sana (hasa katika vipengele vya uadilifu wa juu). Kuna hoja nyingi dhidi ya kuwezesha madai katika uzalishaji, k.m., maktaba hazipaswi kuvuruga waita, uwepo wao unaweza kusababisha kukataliwa na maduka ya programu, na/au kuamilisha madai katika uzalishaji kunaweza kufunua data za faragha kama vile funguo za faragha. Kumbuka kwamba katika usambazaji mwingi wa Linux NDEBUG haijafafanuliwa, hivyo C/C++ assert() kwa chaguo-msingi itawezeshwa kwa uzalishaji katika mazingira hayo. Inaweza kuwa muhimu kutumia utaratibu tofauti wa madai au kufafanua NDEBUG kwa uzalishaji katika mazingira hayo.

    PHPUnit assertions or strict_types alone do not establish many assertions in production code being enabled during dynamic analysis, as required by the Gold criterion. Evidence: https://github.com/netresearch/t3x-nr-llm



Unaweza kutumia zana na mifumo ya AI kupendekeza mabadiliko kupitia URL rahisi, kama vile https://www.bestpractices.dev/sw/projects/11697/choose/edit?osps_ac_01_01_status=Met&osps_ac_01_01_justification=GitHub+enforced. Angalia mfumo wetu wa mapendekezo ya otomatiki kwa jinsi ya kufanya hivyo. Data hii inapatikana chini ya Community Data License Agreement – Permissive, Version 2.0 (CDLA-Permissive-2.0). Hii inamaanisha kuwa Mpokeaji wa Data anaweza kushiriki Data, na au bila marekebisho, mradi Mpokeaji wa Data anapatanisha maandishi ya mkataba huu na Data iliyoshirikiwa. Tafadhali tambua Sebastian Mendel na wachangiaji wa nishani ya Mazoea Bora ya OpenSSF.

Ingizo la nishani ya mradi linamilikiwa na: Sebastian Mendel.
Ingizo liliundwa siku 2026-01-05 22:00:46 UTC, iliyosasishwa mara ya mwisho siku 2026-09-29 15:16:54 UTC. Ilipoteza mara ya mwisho nishani ya kupita siku 2026-09-29 15:16:54 UTC. Ilipata mara ya mwisho nishani ya kupita siku 2026-01-08 20:13:05 UTC.