CHAIN OF CUSTODY · PUBLIC RECORD
Scan directory
Repositories scanned with sscsb, scored by the
published methodology. Every listing passed
a maintainer's review before appearing here. Type any owner/repo
below to search the record — or to put a repository that isn't in it yet
into the scan queue.
No record for this repository yet. Request an unauthenticated sscsb scan — a maintainer reviews every record before it enters the directory.
| Repository scan record |
|---|
|
No description published.
The local record describes commit 3cb129084db2, while the repository scan on this listing describes c8a23493ec0c. Its local-environment rows may predate the code above them.Two scores are on this page and only one of them is ours. The grade and coverage shown here — A+, 100%, coverage 90.9% — are the DIRECTORY's, computed from every evidence source it holds under the published methodology. The signed local record linked below carries its own score block (A+, 100%, coverage 89.5%): that is the SUBMITTER's self-report, computed on their machine over the controls that machine had in scope. It is republished byte-identically because the signature covers those exact bytes, not because the directory endorses the number.
verified2026-09-03
|
|
Sensible Security tools — tools.sensiblesecurity.xyz (landing, sscsb site + public scan directory)
The local record describes commit 710cf8e461f2, while the repository scan on this listing describes 3ab6bf98504b. Its local-environment rows may predate the code above them.Two scores are on this page and only one of them is ours. The grade and coverage shown here — A+, 100%, coverage 87.1% — are the DIRECTORY's, computed from every evidence source it holds under the published methodology. The signed local record linked below carries its own score block (A+, 100%, coverage 86.1%): that is the SUBMITTER's self-report, computed on their machine over the controls that machine had in scope. It is republished byte-identically because the signature covers those exact bytes, not because the directory endorses the number.
verified2026-09-03
|
|
Run sscsb supply-chain-security scans in your own CI — authenticated scan records for tools.sensiblesecurity.xyz/sscsb/
The local record describes commit f37f780cb0f2, while the repository scan on this listing describes c7deeef08747. Its local-environment rows may predate the code above them.Two scores are on this page and only one of them is ours. The grade and coverage shown here — A+, 100%, coverage 87.1% — are the DIRECTORY's, computed from every evidence source it holds under the published methodology. The signed local record linked below carries its own score block (A+, 100%, coverage 86.1%): that is the SUBMITTER's self-report, computed on their machine over the controls that machine had in scope. It is republished byte-identically because the signature covers those exact bytes, not because the directory endorses the number.
verified2026-09-03
|
Two numbers ride with every listing. One is how many of the answered checks — the checks that produced a pass, a fail, or a missing-defence result passed. The other is evidence coverage — how many of the checks produced a yes-or-no answer at all. A low second number is not a mark against the project: it means the scan could not see far enough. Each listing says which checks went unanswered, and why. Where a letter is provisional — the grade stands, but too much went unchecked to treat it as settled, that is the reason. A check that went unanswered is unverified — nobody could answer this check — which is not the same as failing it; one that was looked for and not found is a gap — the defence was looked for and not found. The evidence source — who ran the scan, and therefore how much of the project they could see column says who ran the scan (how that is checked).