OpenSSF Best Practices evidence

This register tracks OpenSSF Best Practices work across Xquik-dev.

It records project scope, live badge entries, shared evidence, and known gaps.

Applicability#

OpenSSF badges apply to FLOSS projects, not automatically to every repository.

OpenSSF defines project sites as supporting project development and dissemination.

See the official criteria terminology.

Xquik-dev has 17 standalone software projects with badge entries.

Two repositories serve those projects without separate releases:

• .github provides shared governance, policies, templates, and organization discovery.
• xquik-docs provides shared API, SDK, integration, and security documentation.

These repositories act as shared project sites and project-result sources.

They do not currently operate as independent released projects.

Create separate badge entries if either repository becomes independently released.

Live project entries#

All 17 project entries achieved Passing before July 23, 2026.

Use each live entry for current status and submitted evidence.

July 25, 2026 audit snapshot#

• Xquik-dev has 19 public repositories.
• Seventeen repositories are standalone software projects.
• All 17 live entries report Passing at 100%.
• Silver completion is 98% for every project.
• Gold completion ranges from 65% to 78%.
• All 55 Silver and 23 Gold fields have explicit classifications.
• No Silver or Gold field remains unknown.
• Every required Silver explanation and evidence URL is present.
• All 17 entries mark 4 verified human requirements as Unmet.
• Each entry includes dated remediation guidance for those requirements.
• All 17 entries mark cryptographic 2FA as Met.
• All 17 projects expose a scoped newcomer task.
• All 17 projects have verified signed release artifacts.
• All 17 software projects protect v* tags against destructive updates.
• All latest public Git tags remain unsigned.
• All 15 projects with qualifying fixes meet the six-month regression ratio.
• Two projects have no qualifying fixes and use N/A.
• All 17 projects meet the current 50% two-person-review threshold.

Shared evidence#

These documents support repository-specific badge evidence:

• Contribution requirements and DCO
• Governance and public roles
• Code review requirements
• Vulnerability response process
• Architecture and security assurance
• Release integrity and verification
• Debug-information preservation evidence
• Six-month regression-test evidence
• Two-person review evidence
• Code of Conduct
• Twelve-month roadmap

Repository-specific evidence must still prove the affected criterion.

Newcomer tasks#

Each standalone project exposes one open, scoped task.

Every task has good first issue and help wanted labels.

These tasks satisfy the Gold small_tasks evidence requirement.

Verified organization controls#

• GitHub requires two-factor authentication for organization members.
• The organization owner prefers a configured passkey for GitHub 2FA.
• An authenticator app provides an additional cryptographic 2FA method.
• SMS is not configured as a GitHub 2FA method.
• Every public repository supports private vulnerability reporting.
• Every default branch requires 1 current approval.
• The last pusher cannot provide that approval.
• Administrators cannot bypass required checks or reviews.
• Every default branch dismisses stale reviews and requires resolved conversations.
• Every default branch blocks force pushes and deletion.
• Seventeen standalone projects have current Passing badges.
• Seventeen standalone projects run required CI checks.

Technical baseline adoption#

These pull requests establish project-specific and shared technical controls.

All 19 baseline pull requests have merged.

Do not count pending changes as default-branch evidence.

Java #17 records 94.05% generated-inclusive line coverage and 92.81% branch coverage.

Kotlin #14 records 92.70% generated-inclusive line coverage and 91.87% branch coverage.

TypeScript #18 adds 2 regression guards.

Hermes #612 and Paperclip #6 add reproducible-package evidence.

All 17 projects now have default-branch debug-preservation evidence.

Terraform #14 and CLI #16 merged independently reviewed verification.

See debug-information evidence for the complete assessment.

Other open pull request audit#

• Core #9 remains a conflicting draft.
• Core #10 remains a behind-base draft.
• Both drafts contain explicit release blocks.
• Do not update, merge, tag, or publish either draft.
• Haystack #6 is an independent contribution for issue #5.
• Its added file passes Ruff, and all 18 unit tests pass locally.
• Contributor commit faf5d270 lacks the required DCO sign-off.
• The contributor must amend and re-push it before this PR qualifies as evidence.
• Required remote checks pass with zero unresolved review threads.
• The contributor's next push will require a new independent approval.

README & repository metadata#

Maintainers audited all 19 public READMEs on July 24, 2026.

All default branches contain the approved independence disclosure.

All 19 default branches contain the exact unformatted footer.

All repository descriptions identify their supported purpose.

All descriptions include the compact independence notice.

Topics remain specific to supported languages, workflows, and customer tasks.

Every public repository now includes the xquik discovery topic.

Descriptions contain 94 to 140 characters.

Each opening sentence contains 9 to 14 words.

Each repository uses 14 to 20 accurate topics.

The public contract check now preserves these discovery requirements:

• One clear README title and at least 3 descriptive sections.
• A task-oriented section and copyable example for each project repository.
• Descriptive link text and alternative text for images.
• An HTTPS homepage and a concise repository description.
• The xquik topic and at least one supported customer-intent topic.
• No more than 20 repository topics.

These checks favor useful structure and accurate terms.

They do not require keyword lists or duplicate questions.

Known Gold gaps#

A second reviewer has repository write access.

Public evidence still does not prove full release and legal continuity.

The projects do not yet meet this required Silver prerequisite:

• Continuity after the loss of any one project member.

They do not yet meet these human Gold requirements:

• A bus factor of 2 or more.
• Two unassociated significant contributors per project.
• A human security review completed within the last 5 years.

Open remediation pull requests cannot satisfy these human requirements.

Track human prerequisites in organization issue #3.

Track the maintainer nomination in organization issue #8.

Track scoped human reviews in organization issue #5.

x-twitter-scraper currently has 41.7% two-person review coverage.

Restore its 50% threshold before the next major release.

All 17 projects now have project-controlled release signature evidence.

Never mark a criterion as met without current public evidence.

Review this register after repository, badge, or criteria changes.

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.