The directory
Every scan on the record
Repositories scanned with sscsb, scored by the published methodology. A person reviewed every listing before it appeared.
Not listed yet. A scan can be run from outside, and a person reviews the result before it publishes.
| Grade | Repository | Phases | Evidence source | Scanned |
|---|---|---|---|---|
| A+ |
p4gs/sscs-bootstrapper
Different commitlocal record at 3cb129084db2, this scan at c8a23493ec0c both score A+ 100%The local record describes commit 3cb129084db2, while the repository scan on this listing describes c8a23493ec0c. Its local-environment rows may predate the code above them. Two scores are on this page and only one of them is ours. The grade and coverage shown here — A+, 100%, coverage 90.9% — are the DIRECTORY's, computed from every evidence source it holds under the published methodology. The signed local record linked below carries its own score block (A+, 100%, coverage 89.5%): that is the SUBMITTER's self-report, computed on their machine over the controls that machine had in scope. It is republished byte-identically because the signature covers those exact bytes, not because the directory endorses the number. |
CI · verified | 2026-09-03 | |
| A+ |
p4gs/p4gs.github.io
Sensible Security tools — tools.sensiblesecurity.xyz (landing, sscsb site + public scan directory)
Different commitlocal record at 710cf8e461f2, this scan at 3ab6bf98504b both score A+ 100%The local record describes commit 710cf8e461f2, while the repository scan on this listing describes 3ab6bf98504b. Its local-environment rows may predate the code above them. Two scores are on this page and only one of them is ours. The grade and coverage shown here — A+, 100%, coverage 87.1% — are the DIRECTORY's, computed from every evidence source it holds under the published methodology. The signed local record linked below carries its own score block (A+, 100%, coverage 86.1%): that is the SUBMITTER's self-report, computed on their machine over the controls that machine had in scope. It is republished byte-identically because the signature covers those exact bytes, not because the directory endorses the number. |
CI · verified | 2026-09-03 | |
| A+ |
p4gs/sscsb-action
Run sscsb supply-chain-security scans in your own CI — authenticated scan records for tools.sensiblesecurity.xyz/sscsb/
Different commitlocal record at f37f780cb0f2, this scan at c7deeef08747 both score A+ 100%The local record describes commit f37f780cb0f2, while the repository scan on this listing describes c7deeef08747. Its local-environment rows may predate the code above them. Two scores are on this page and only one of them is ours. The grade and coverage shown here — A+, 100%, coverage 87.1% — are the DIRECTORY's, computed from every evidence source it holds under the published methodology. The signed local record linked below carries its own score block (A+, 100%, coverage 86.1%): that is the SUBMITTER's self-report, computed on their machine over the controls that machine had in scope. It is republished byte-identically because the signature covers those exact bytes, not because the directory endorses the number. |
CI · verified | 2026-09-03 |
No listing matches that. Every repository is shown when the search box is empty and the filter is off. No listing is under the 75% coverage floor. The lowest on the board is 87.1%.
Key pass did not pass gap no answer out of scope not in this record
no answer — no lane available here could answer it, which is not the same as failing it.
Phases P1Commit integrity P2Dependencies P3Build receipts P4Code & build hardening P5Ongoing posture P6Distribution & publishing
Evidence source
CI · verifiedAuthenticated scan from the repository's own CI; signature verified against its workflow identity CI · unsignedAuthenticated-lane record without a verified signature — an unverified claim Local · signedWorkstation scan signed by a key this repository commits in .sscsb/policy/allowed_signers — attributable, but weaker than the action lane, which proves the repository's own CI ran the scan. Its local-environment verdicts count on their own; anything a repository scan could observe waits for an independent record to agree. Outside-inOutside-in scan by the directory; GitHub-side checks ran with public-only visibilityTwo numbers ride with every listing. One is how many of the answered checks — the checks that produced a pass, a fail, or a missing-defence result passed. The other is evidence coverage — how many of the checks produced a yes-or-no answer at all. A low second number is not a mark against the project: it means the scan could not see far enough. Each listing says which checks went unanswered, and why. Where a letter is provisional — the grade stands, but too much went unchecked to treat it as settled, that is the reason. A check that went unanswered is unverified — no lane available here could answer it — which is not the same as failing it; one that was looked for and not found is a gap — the defence was looked for and not found. The evidence source — who ran the scan, and therefore how much of the project they could see column says who ran the scan (how that is checked).