docs(security): complete the OpenSSF Best Practices assessment #15

New Issue

2026-10-10T16:58:45Z

KofTwentyTwo commented

2026-10-10 16:58:45 +00:00

(Migrated from github.com)

Problem

Scorecard alert #5 reports no Best Practices badge. The 67-criterion evidence worksheet is prepared; no project entry exists.

Acceptance criteria

Register the project; complete evidence-backed criteria and owner attestations; address failed criteria; add a valid badge only once earned; verify Scorecard result.

Scope

AppKit, owner registration/knowledge attestations required.

This issue is part of the user-requested AppKit readiness remediation. Local work is not completion until the applicable published/runtime state and checks are verified. Substantial AI assistance: Codex.

## Problem Scorecard alert #5 reports no Best Practices badge. The 67-criterion evidence worksheet is prepared; no project entry exists. ## Acceptance criteria Register the project; complete evidence-backed criteria and owner attestations; address failed criteria; add a valid badge only once earned; verify Scorecard result. ## Scope AppKit, owner registration/knowledge attestations required. This issue is part of the user-requested AppKit readiness remediation. Local work is not completion until the applicable published/runtime state and checks are verified. Substantial AI assistance: Codex.

KofTwentyTwo commented

2026-10-10 17:52:27 +00:00

(Migrated from github.com)

The OpenSSF evidence worksheet and truthful Scorecard assessment are committed locally in AppKit 36886cbaae8810bf9c9a3c85867a2cee51d0ba3d.

The worksheet covers all 67 passing criteria and distinguishes repository evidence from owner attestations. It does not claim certification or independent human review.

Remaining: register the project at bestpractices.dev, complete owner attestations and close any actual criterion gaps, then verify the resulting public badge. No project registration or certification has been fabricated. Signed commit; AI assistance: Codex (GPT-6).

The OpenSSF evidence worksheet and truthful Scorecard assessment are committed locally in AppKit `36886cbaae8810bf9c9a3c85867a2cee51d0ba3d`. The worksheet covers all 67 passing criteria and distinguishes repository evidence from owner attestations. It does not claim certification or independent human review. Remaining: register the project at bestpractices.dev, complete owner attestations and close any actual criterion gaps, then verify the resulting public badge. No project registration or certification has been fabricated. Signed commit; AI assistance: Codex (GPT-6).

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/AppKit#15