Rightshold™ Sign up

Safety ratings

Methodology

Automated checks of public signals as of the date shown. Not a security audit, certification or endorsement, and not a statement about the people who maintain the project. Signals can be incomplete or out of date; each check shows its evidence and source so anyone can verify it.

Check version: rs-safety-checks-1.0. No AI is used in scoring; the same facts always give the same score. Rulebook hash: c02a6c4ba968afe595111beff541daa0c215ec8ee41ca81329a8c06c23108886.

Score

score = round(100 × points earned ÷ points available). Checks marked not_applicable (no lockfile, no Scorecard result, not an MCP server) are removed from both sides, so a project is never marked down for a signal that does not apply to it.

Bands: Strong public signals (85+), Good public signals (70+), Moderate public signals (50+), Limited public signals (0+).

Checks

Data sources

Open sweep collector (collector_version on each rating). It stores file paths and pattern names only, never file contents or matched secret values.

Ledger

Every rating is sealed on the Rightshold ledger as entry type safety.rating (stream safety_ratings) with its as_of date, check_version, score and rating_sha256. Re-checks add new entries; old ones are never edited. Verify at https://www.rightshold.com/v1/ledger.

Maintainers (free)