Honest arithmetic
A check that could not run is a third state. It is shown as a dashed ring and left out of the sums. An unanswered check is never a verdict, and A+ means every answered check passed.
How scoring works →SUPPLY-CHAIN SECURITY · SCANNED IN PUBLIC
What each repository can prove — and what nobody could check.
Every listing here is a public record of one scan of one commit.
Already listed.
Open the listing →Not on file yet. Ask for a scan — a person reviews every result before it appears.
Already listedp4gs/p4gs.github.iop4gs/sscs-bootstrapperp4gs/sscsb-action
- 01sourceclone, never execute
- 02resolvesnapshot before setup
- 03evaluate54 checks, each answered or left unanswered
- 04signthe record, in the open
Listings
3
Checks answered
84
Median passed
100%
Last scan
2026-09-03
Best scoring
Top rated
The listings that passed the most of what could be checked.
A "best scoring" list needs 12 listings and more than one grade among them. Otherwise it is just a tie, broken by a number this site says not to hold against anyone. There are 3 listings and 1 grade so far.
Browse every listing →Freshest evidence
Recently scanned
A scan is a snapshot of one commit. These are the newest.
Every listing here was scanned by the same scheduled run, minutes apart, so ordering them by date would be ordering noise. This fills in once projects run their own scans on their own schedules.
Browse every listing →Across every listing
Still unchecked
The checks that most often have no answer here — and why.
-
Does the project say which vulnerabilities actually apply to it?
openvex3 of 3 only a maintainer's own machine can answer this -
Does the project publish an OpenSSF Scorecard result?
scorecard3 of 3 no source could answer it -
Is signing set up the same way in every environment?
signing-model3 of 3 only a maintainer's own machine can answer this -
Are installed tools and extensions checked against known compromises?
bumblebee2 of 3 only a maintainer's own machine can answer this
3 of these 4 describe a developer's own machine. No scan from outside can see them — a maintainer answers them by running the scan themselves and signing the result. How that is checked →
What the checks are for
Nine ways supply chains get attacked
Every check defends against at least one of these — or says plainly that it defends against none, and only tells outsiders what a project does.
Each one, with what it looked like when it happened →brew install p4gs/p4gs/sscsb
Run it in your own build
A scan from outside sees only what anyone can see. Run sscsb in your own build and it sees the rest. It then signs the result, so the signature proves where the record came from.
Install the Action →The checks only you can answer
About a dozen checks describe a developer's own laptop, where no scan can reach. A maintainer answers those by running the scan there and signing it. The key they sign with is one the project already publishes.
How that is checked →