ledger · public record
Scan directory
Every repository here was scanned with sscsb and scored by published rules. A person reviewed each result before it appeared. The evidence source — who ran the scan, and therefore how much of the project they could see column says who ran the scan. ✓ verified means the repository's own build ran it and signed the result (how that is checked).
Not in the ledger yet. Request an unauthenticated sscsb scan — every record passes a maintainer's review before it's published.
| Seal | Repository | Phases | Evidence source | Scanned |
|---|---|---|---|---|
| A+ | p4gs/sscs-bootstrapper The local record describes commit 3cb129084db2, while the repository scan on this listing describes c8a23493ec0c. Its local-environment rows may predate the code above them.Two scores are on this page and only one of them is ours. The grade and coverage shown here — A+, 100%, coverage 90.9% — are the DIRECTORY's, computed from every evidence source it holds under the published methodology. The signed local record linked below carries its own score block (A+, 100%, coverage 89.5%): that is the SUBMITTER's self-report, computed on their machine over the controls that machine had in scope. It is republished byte-identically because the signature covers those exact bytes, not because the directory endorses the number. | ✓ verified | 2026-09-03 | |
| A+ | p4gs/p4gs.github.io Sensible Security tools — tools.sensiblesecurity.xyz (landing, sscsb site + public scan directory) The local record describes commit 710cf8e461f2, while the repository scan on this listing describes 3ab6bf98504b. Its local-environment rows may predate the code above them.Two scores are on this page and only one of them is ours. The grade and coverage shown here — A+, 100%, coverage 87.1% — are the DIRECTORY's, computed from every evidence source it holds under the published methodology. The signed local record linked below carries its own score block (A+, 100%, coverage 86.1%): that is the SUBMITTER's self-report, computed on their machine over the controls that machine had in scope. It is republished byte-identically because the signature covers those exact bytes, not because the directory endorses the number. | ✓ verified | 2026-09-03 | |
| A+ | p4gs/sscsb-action Run sscsb supply-chain-security scans in your own CI — authenticated scan records for tools.sensiblesecurity.xyz/sscsb/ The local record describes commit f37f780cb0f2, while the repository scan on this listing describes c7deeef08747. Its local-environment rows may predate the code above them.Two scores are on this page and only one of them is ours. The grade and coverage shown here — A+, 100%, coverage 87.1% — are the DIRECTORY's, computed from every evidence source it holds under the published methodology. The signed local record linked below carries its own score block (A+, 100%, coverage 86.1%): that is the SUBMITTER's self-report, computed on their machine over the controls that machine had in scope. It is republished byte-identically because the signature covers those exact bytes, not because the directory endorses the number. | ✓ verified | 2026-09-03 |
Two numbers ride with every listing. One is how many of the answered checks — the checks that produced a pass, a fail, or a missing-defence result passed. The other is evidence coverage — how many of the checks produced a yes-or-no answer at all. A low second number is not a mark against the project: it means the scan could not see far enough. Each listing says which checks went unanswered, and why. Where a letter is provisional — the grade stands, but too much went unchecked to treat it as settled, that is the reason. A check that went unanswered is unverified — nobody could answer this check — which is not the same as failing it; one that was looked for and not found is a gap — the defence was looked for and not found. The evidence source — who ran the scan, and therefore how much of the project they could see column says who ran the scan (how that is checked).