I think you miss the point then. The things it's looking for are indicators security practices are even in place. If you wanted vuln scanning, many solutions for that today exist. This is almost like a reputation score. The higher it is, the more likely vulnerabilities will be addressed in the future (or outright prevented).

I like the idea, I think it will just be tough to work out the right heuristics.

Having a quantitative, ordinal scale gives the wrong picture I think. Since 10/10 sounds good, but doesn’t actually mean something is safe.

Also the name is “scorecard” that again connotes that a high score is good. I don’t get a 10/10 on my assignment because I did my homework, said hello to the teacher each morning, and was polite to my classmates.

Those are all positive things and if I wanted to measure students they may be a part of the grade. But if I only graded on these factors that’s not terribly useful.

Process measures are good when it’s not possible to measure outcome, but I think in this situation more outcome measures could be factored in.

These are just some initial metrics we picked for v1. Please suggest more by filing by a github issue here - https://github.com/ossf/scorecard/issues Over time, we will add more real time metrics such as open vulnerabilities, etc

Yes, we will automate score capturing over all projects in real-time in the future. https://github.com/ossf/scorecard/issues/12

The work to capture current vuln state is tracked in https://github.com/ossf/scorecard/issues/52

Cool, thanks for working on this.