Determines if the project's GitHub Action workflows avoid dangerous patterns.

Determines if the project has generated executable (binary) artifacts in the source repository.

Determines if the default and release branches are protected with GitHub's branch protection settings.

Determines if the project requires code review before pull requests (aka merge requests) are merged.

Determines if the project uses a dependency update tool.

Determines if the project is "actively maintained".

Determines if the project cryptographically signs release artifacts.

Determines if the project's workflows follow the principle of least privilege.

Determines if the project has open, known unfixed vulnerabilities.

Determines if the project uses fuzzing.

Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.

Determines if the project has declared and pinned the dependencies of its build process.

Determines if the project uses static code analysis.

Determines if the project has published a security policy.

Determines if the project runs tests before pull requests are merged.

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

Determines if the project has a set of contributors from multiple organizations (e.g., companies).

Determines if the project has defined a license.