Before a repository gets a post here we clone it and run the same checks on every one. The scanner is a script in this site's own repository, its findings are written out with file and line, and a person reads every hit before writing the verdict in the post. The last full run was on Oct 3, 2026.
- Pinned commit
- A fresh clone of the default branch. The commit and date are on every report, so the findings are about one snapshot, not the repository in general.
- Secrets
- Credential patterns with a known shape: cloud access keys, API tokens for OpenAI, Anthropic, Slack, GitHub, Google and Stripe, chat webhooks, private key blocks.
- Suspicious code
- Code that decodes a string and then executes it, pipes a download straight into a shell, opens a raw socket to a shell, reaches a known exfiltration service, mines cryptocurrency, or looks packed.
- Install-time code
- npm lifecycle scripts, setup.py command classes, Cargo build scripts, and installer shell scripts: whether they use sudo, edit your shell profile, or fetch and run remote code.
- Committed binaries
- Executables and compiled objects identified by their bytes, not their file extension, so a renamed binary still shows up.
- CI workflows
- GitHub Actions that run on pull_request_target and check out the pull request head (a classic way to leak secrets), write-all permissions, and third-party actions pinned to a tag instead of a commit.
- Network hosts
- Every host the source code talks to, so an unexpected one stands out.
- Known vulnerabilities
- Every pinned dependency in the repository's lockfiles looked up in OSV.dev, counted by severity. Includes development dependencies, which is why the counts are not zero for a large web app.
- Project hygiene
- A security policy, automated dependency updates, CodeQL, a licence, contributing guidelines.
- OpenSSF Scorecard
- The Open Source Security Foundation's independent score, where the project has one.
Safe means no credential patterns, no decode-and-execute code, no exfiltration hosts, no undocumented install-time behaviour, no risky workflow, and nothing in the findings a reviewer could not explain. Anything you should know before installing (an installer that pipes to a shell, a tool that reads a credential you already have, a licence with conditions, or a lockfile with unpatched advisories) is the note beside the badge.
Not covered: we do not run the software, audit its logic, or review commits made after the scan. The date and commit are on every report. Check them, and read the code yourself before you trust it with anything that matters.
