Safety rating · all kinds

openai

Score 100/100 — Strong public signals

Automated checks of public signals as of the date shown. Not a security audit, certification or endorsement, and not a statement about the people who maintain the project. Signals can be incomplete or out of date; each check shows its evidence and source so anyone can verify it.

Checks

• License recorded (OSI-approved) — Found (10/10): License Apache-2.0 (OSI-approved) is recorded in the registry metadata.
• Known advisories for the latest version (OSV) — Found (15/15): 1 package version(s) checked against OSV; no matching advisories.
• Install lifecycle scripts in the latest version — Found (12/12): The latest version declares no preinstall/install/postinstall scripts.
• Runtime dependencies pinned to exact versions — Found (9/9): The latest version declares no runtime dependencies.
• Build provenance / trusted publishing — Found (8/8): The registry records build attestations for the latest version.
• Maintainer activity (publish recency and cadence) — Found (10/10): Most recent publish 1 day(s) before the check; 91 release(s) in the prior 365 days.
• Registry state (not deprecated) — Found (8/8): The latest version is not marked deprecated in the registry.
• Registry metadata completeness — Found (8/8): Registry metadata present: description, repository, homepage, readme.
• Maintainer breadth (bus factor signal) — Found (12/12): 19 maintainer(s) are recorded on the registry entry (count only).