Objective: When we evaluate an open-source tool for our needs, we don’t just look at security. Another important aspect is how well the company maintains its codebase. We want to know about their internal processes and structure for keeping the code in good shape.
Outcome: To assess code quality and maintenance, we check various factors and give the tool an overall score. This score tells you how well the tool is maintained and the quality of its code. The factors that are evaluated are-
  1. Maintenance: Ongoing project support.
  2. Code Review: Inspection for code quality.
  3. Token Permissions: Access control for tokens.
  4. Vulnerabilities: Security weaknesses.
We provide an overview, score, and details to assist with assessing code maintenance. A good score represents a company that has set up well-structured processes that help maintain the code quality and ensure no harmful or miscellaneous practices are happening with the code. We are currently using OpenSSF to fetch this data and using our scoring mechanism to calculate the score.