Check C8 · provenance family · severity HIGH · automatic · one of the 22 checks
The question this check asks: what does the OpenSSF's own scanner say about how this project is run — and, specifically, does it run untrusted code in its workflows or keep binaries in its tree?
The OpenSSF Scorecard is twenty checks, free, with no download, run by the OpenSSF on a schedule against the projects it covers. It measures process: branch protection, dependency pinning, signed releases, whether CI workflows run code from pull requests, whether binaries are committed. The repository vetting standard's rule for reading it is short and deliberately asymmetric — treat a low score as disqualifying and a high score as meaningless — because Scorecard measures hygiene, not malice, and a purpose-built malicious repository can score well on every line. Two of its checks are worth reading alone: Dangerous-Workflow, which is a CI pipeline that will run a stranger's code, and Binary-Artifacts, which is the same question as our own committed-binaries check answered by a second party.
C8 asks the public Scorecard API for the repository's latest result. If Dangerous-Workflow or Binary-Artifacts scored under 5 out of 10, that check fires at severity HIGH and costs 8 points — “Scorecard 'Dangerous-Workflow' is failing”; verdict REVIEW at 92, and the default policy warns. If the overall score is under 3, a second finding fires at MEDIUM for 4 points — “Scorecard 2.1/10 — weak process hygiene”. Both thresholds are policy parameters. A repository Scorecard has never scanned gets a note — no Scorecard entry (unscanned project) — and no finding; and a good score adds nothing. The evidence notes in the scoring table:
“Dangerous-Workflow / Binary-Artifacts failing” · “process hygiene only”
Scorecard is GitHub-shaped: the standard's own caveat is that projects on other forges score artificially low, which is a measurement artefact and not a risk finding. Small projects with no CI, no branch protection and one maintainer score low on hygiene while being perfectly honest, which is why the overall-score finding is 4 points and a warning. And Scorecard runs on a schedule, so its result can lag a repository's state by days.
Most of GitHub. Scorecard's public API covers the projects it scans, and the great majority of repositories — including nearly every fresh one, which is where the campaigns live — have no entry. This check contributes nothing to the FakeGit catch rate for that reason, and says so. It does not measure malice at all: a repository can pin its dependencies, protect its branches and sign its releases while shipping a trojan as the signed release. It is a second opinion on hygiene, weighted as one.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser.
Without installing anything: the Scorecard result is public at scorecard.dev/viewer/?uri=github.com/OWNER/REPO. From a terminal, the two checks that matter and the overall score:
curl -s https://api.scorecard.dev/projects/github.com/OWNER/REPO | jq '{score, checks: [.checks[] | select(.name == "Dangerous-Workflow" or .name == "Binary-Artifacts") | {name, score}]}'A 404 means unscanned, not bad. A Dangerous-Workflow below 5 means a workflow in the repository will run code from a pull request; read the workflow before you trust anything the CI produced.
Does a high Scorecard mean the repository is safe? No. Scorecard measures process hygiene — branch protection, pinned dependencies, signed releases, no binaries in the tree. A purpose-built malicious repository can score well on all of it. The vetting standard's rule is to treat a low score as disqualifying and a high score as meaningless, and RepoGates does exactly that: a good Scorecard adds nothing, a bad one costs a little.
My repository has no Scorecard entry — is that penalised? No. Scorecard's public API covers the projects it scans, which is a fraction of GitHub, and most repositories have no entry. RepoGates records a note — no Scorecard entry, unscanned project — and no finding. Absence of a scan is not evidence of anything.
Does RepoGates stop git clone? No. Browser-initiated downloads only.
C15 Committed binaries — our own answer to Binary-Artifacts, from the file list · C7 Maintenance activity — the rest of the hygiene baseline · C9 Release-asset binaries — what a well-scored repository can still ship.
Add RepoGates to Chrome Pricing
Numbers on this page: the OpenSSF Scorecard's published checks; thresholds and weights from the product's policy and scoring tables. Check numbering follows the product's catalogue.