Methodology
How the score works
Last updated 3 September 2026
Every security score on this site comes from the checks below. They are hand-written rules, not a trained model, and nothing about a person is scored. If you think a result is wrong,tell us — the observations are checkable, which is the point of publishing them.
What the score is
A repository starts at 100. Each check that fails subtracts its weight. Checks that cannot be read subtract nothing and are marked unknown. So the number is100 minus what we could see going wrong — not a measure of how safe a project is.
The weighting is our judgement. We chose these numbers because they seemed proportionate; someone else would choose differently, and we may change them. A score computed today may not be reproducible after a change. Every score carries the date it was computed.
The checks
| Check | What it reads | Weight |
|---|---|---|
| License | GET /repos/{owner}/{repo} → license | 10 |
| Issue tracker | Same call → has_issues | 10 |
| Security policy | Presence of SECURITY.md, .github/SECURITY.md ordocs/SECURITY.md | 10 |
| Branch protection | GET /repos/.../branches/{default}/protection. Only repository admins can read this, so for most repositories it comes back unknown and costs nothing. | 10 |
| Code scanning alerts | GET /repos/.../code-scanning/alerts. Not set up is not a failure and is not scored. | 10 |
| Dependabot config | Presence of .github/dependabot.yml | 5 |
What is shown but never scored
These appear in the result because they are useful context, and they subtract nothing. They used to count and no longer do — a project that keeps its wiki closed or carries a long issue backlog is not less secure for it.
- Wiki — open or disabled
- Projects — open or disabled
- Open issues — the count
What the score does not do
- It does not read your code. No file contents are analysed by the security score — only repository metadata and the presence of a few well-known files.
- It finds nothing about vulnerabilities, dependencies, or whether a project has ever been compromised.
- It cannot distinguish a project that does not need something from one that neglected it. A single-author script with no branch protection is not doing anything wrong.
- Two repositories can reach the same score for entirely different reasons. Read the criteria, not the number.
Where the numbers come from
Every check runs in your browser against GitHub's documented REST API. Signed in, it uses your own GitHub token and your own rate limit of 5,000 requests an hour. Signed out, it uses GitHub's anonymous limit of 60 requests an hour, which everyone on your network shares. Nothing is proxied through a server, and we never receive your token. We do not read github.com web pages.