kushaldas/kryptering holds a health index of 61 out of 100, placing it in the Moderate band. It scores highest on Vitality (81/100) and lowest on Community & Adoption (34/100). It was last updated today. A single contributor accounts for most of its recent work.
61
overall / 100
Moderate
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
61
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Manageable file sizes — 0/32 source files over 60KB
Inputs used
primary_language
Rust
largest_source_bytes
58,427
source_files_sampled
32
oversized_source_files
0
Key facts
1GitHub stars
3contributors
58commits, last 12 months
0days since last push
6releases
1bus factor
0open issues
crates.iopackage ecosystems
Data collection warnings
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
deps.dev does not index crates:kryptering@0.5.0; advisories assessed against the repository dependency graph instead
More detail
Star and fork history 0 ★ / 2 ⇿
0Stars
2Forks
3Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 0Minor 2Patch 1
OpenSSF Scorecard 5.2 / 10
5.2aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-23 11:56 UTC
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 315,
"has_wiki": true,
"homepage": null,
"languages": {
"Rust": 510306
},
"pushed_at": "2026-07-23T07:37:44Z",
"created_at": "2026-04-02T15:24:17Z",
"owner_type": "User",
"updated_at": "2026-07-23T07:36:15Z",
"description": null,
"is_archived": false,
"is_disabled": false,
"license_spdx": "BSD-2-Clause",
"default_branch": "main",
"license_spdx_raw": "BSD-2-Clause",
"primary_language": "Rust",
"significant_languages": [
"Rust"
]
},
"owner": {
"blog": "https://kushaldas.in",
"name": "Kushal Das",
"type": "User",
"login": "kushaldas",
"company": "@SUNET",
"location": "Stockholm",
"followers": 943,
"avatar_url": "https://avatars.githubusercontent.com/u/272303?v=4",
"created_at": "2010-05-10T12:02:20Z",
"is_verified": null,
"public_repos": 225,
"account_age_days": 5917
},
"license": {
"state": "standard",
"spdx_id": "BSD-2-Clause",
"raw_spdx": "BSD-2-Clause",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-07-23T07:42:36Z"
},
{
"tag": "v0.4.1",
"kind": "patch",
"published_at": "2026-07-01T09:37:14Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2026-06-27T10:56:21Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2026-06-01T12:31:51Z"
},
{
"tag": "v0.2.1",
"kind": "patch",
"published_at": "2026-04-23T12:20:32Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-04-23T09:26:44Z"
}
],
"recent_commits": [
{
"oid": "cb733df24eec02bc548547fb2c51f9987180ba34",
"body": "feat: 6 algos draft-ietf-jose-pq-composite-sigs-03",
"is_bot": false,
"headline": "Merge pull request #13 from kushaldas/feat/hybrid",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-23T07:36:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7969ef7903fdcf25d0960ad6618666441c91d222",
"body": null,
"is_bot": false,
"headline": "fix: review comment",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-23T07:20:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "04efecb4f8d5c98975ccd0211245b3be31c5027f",
"body": "- Add composite algorithm and key variants\n- Support aggregate raw key generation, import, and export\n- Implement required prehashing and domain separation\n- Support ECDSA, Ed25519, and Ed448 traditional components\n- Require both signature components to verify\n- Validate key consistency and exact encoding lengths\n- Zeroize aggregate private key material\n- Add round-trip, negative, and draft representative tests\n- Document provider support, RNG behavior, and Ed448 dependency",
"is_bot": false,
"headline": "feat: 6 algos draft-ietf-jose-pq-composite-sigs-03",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-23T07:09:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "da109f7d70ebb9575362224297cbe3989201c8cc",
"body": "Feat/fips",
"is_bot": false,
"headline": "Merge pull request #12 from kushaldas/feat/fips",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-20T13:55:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f43dd4a0dc10452d23222802084a47345b595b2a",
"body": null,
"is_bot": false,
"headline": "fix: failing CI baseline",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-20T13:48:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4ce43c3a54af99baf78e26eb06714c00786c16cd",
"body": null,
"is_bot": false,
"headline": "fix: review comments",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-20T12:49:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3a985fc960279d3eac95bfaf4e9da8bfcdb811a2",
"body": "- PKCS#12 operation mismatch\n (https://github.com/kushaldas/kryptering/pull/12#discussion_r3614018202)\n- DH public-component documentation\n (https://github.com/kushaldas/kryptering/pull/12#discussion_r3614018225)",
"is_bot": false,
"headline": "fix: review comments",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-20T12:16:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "371946e8364d2e387d2565d153d4b08baefccc07",
"body": null,
"is_bot": false,
"headline": "fix: review comment",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-20T11:40:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34287df17df48951d0317365615695a1f17e8c8b",
"body": "Route RustCrypto nonce and IV generation through the selected provider's\nfallible, OS-backed randomness boundary. This avoids process-local RNG\nstate across fork boundaries and lets ordinary random-byte failures\npropagate as Error::Crypto instead of panicking.\n\n- use OsRng::try_fill_bytes in the Rus\n[…]\ndd ADR 0002 covering AWS-LC selection, the sealed Provider trait,\n no-fallback guarantees, and requirements for future backends\n- link the provider architecture ADR from the README and provider guide",
"is_bot": false,
"headline": "fix: harden provider randomness and document backend design",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-20T08:09:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "005cefb9d6e65a332a42b444b366f410962353e0",
"body": "Harden the RustCrypto and AWS-LC provider boundary so switching providers\ndoes not silently weaken security behavior, and expand FIPS enforcement\nand correctness coverage.\n\nProvider parity and hardening:\n\n- reject unauthenticated AES-CBC through the AWS-LC generic cipher API,\n matching RustCrypto w\n[…]\ng, AWS-LC, and FIPS TLS provider configuration\n- run FIPS known-answer tests in CI\n- use locked dependency resolution for invalid-feature checks\n- pin all remaining GitHub Actions to immutable commits",
"is_bot": false,
"headline": "fix: close provider parity and FIPS assurance gaps",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-20T07:44:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e6ae41efb3eb5d61dc19730f582688108d517a2e",
"body": null,
"is_bot": false,
"headline": "fix: security fixes from review",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-19T11:23:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dd0d181e3b38896d66e5bd6aa3a978a8a58265f0",
"body": "Introduce a compile-time cryptographic provider boundary covering document\ncryptography, randomness, key handling, signatures, ciphers, agreement,\nkey derivation, and streaming digest operations.\n\n- support RustCrypto and AWS-LC document providers\n- support ring and AWS-LC rustls providers independe\n[…]\nKING CHANGE: provider features are now mutually exclusive, FIPS requires\nexplicit backend initialization, software keys are opaque, and previously\ninfallible provider-dependent APIs now return Result.",
"is_bot": false,
"headline": "feat!: add selectable RustCrypto and AWS-LC providers",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-19T11:12:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "475588f822d6963f60bb71c3d32fd4c52235f8ff",
"body": "feat: 0.5.0 ML-KEM (FIPS 203) key encapsulation",
"is_bot": false,
"headline": "Merge pull request #11 from kushaldas/feat/ml-kem",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-09T16:27:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ae2777625b75b7d5752331fd83c78e15a35d968a",
"body": null,
"is_bot": false,
"headline": "fix: review comments",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-09T16:23:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "22701307502dc9f27ea4853b949c89eca3d8b22e",
"body": "Add ML-KEM-512/768/1024 support to the software backend behind the\npost-quantum feature, using RustCrypto ml-kem 0.3.2:\n\n- New Encapsulator/Decapsulator traits and SoftwareEncapsulator/\n SoftwareDecapsulator implementations, plus generate_ml_kem().\n- Keys follow the ML-DSA conventions: SPKI DER pub\n[…]\nchange.\n\nBreaking: PqAlgorithm gains an MlKem variant (affects downstream\nexhaustive matches). MSRV raised 1.83 -> 1.85, already required by\nthe locked rand_core 0.10 post-quantum wave (ml-dsa 0.1.1).",
"is_bot": false,
"headline": "feat: 0.5.0 ML-KEM (FIPS 203) key encapsulation",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-09T14:50:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fa47cac5f0bfbaf1ecd879e2694adca76152e836",
"body": "feat: adds ML-KEM support",
"is_bot": false,
"headline": "Merge pull request #10 from kushaldas/feat/kem",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-07T12:43:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0fc8c61ee348b901e579f617d74c8a9998590f96",
"body": null,
"is_bot": false,
"headline": "fix: review comment",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-07T12:35:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b9f4856c7b543ce4843cc3d303eb7038f1a0e9b3",
"body": null,
"is_bot": false,
"headline": "fix: review comment",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-07T12:26:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9470fac31f139435951257c2acc4c0467f97ee7e",
"body": null,
"is_bot": false,
"headline": "feat: adds ML-KEM support",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-07T11:17:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f1072ed319cbf4863f3b6d852d4a9150204aaeb",
"body": "feat: 0.4.1 cipher 0.5 wave + dependency refresh",
"is_bot": false,
"headline": "Merge pull request #9 from kushaldas/feat/release",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-01T09:35:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0eef810d77948f13b3ae6512d0658bf2525a4feb",
"body": "Bump the cipher 0.5 wave to current stable finals and migrate the\naffected code onto the new trait APIs:\n\n- aes 0.8->0.9, aes-gcm 0.10->0.11, aes-kw 0.2->0.3, cbc 0.1->0.2, des\n 0.8->0.9 (legacy); cipher 0.4->0.5 transitively.\n- cbc: BlockEncryptMut/BlockDecryptMut ->\n BlockModeEncrypt/BlockModeDe\n[…]\nhe digest 0.11\n wave stays blocked.\n\nThe digest 0.11 / signature 3 / rand_core 0.10 wave remains blocked on\nstable rsa 0.10 / ecdsa 0.17 / dalek 3, which are RC-only. Documented in\ndocs/ecosystem.md.",
"is_bot": false,
"headline": "feat: 0.4.1 cipher 0.5 wave + dependency refresh",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-07-01T09:26:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "caabaf3965392f9c0d45f4c6e0cfd61f52259ebe",
"body": "Gate PKCS#11 backend on non-wasm32 targets",
"is_bot": false,
"headline": "Merge pull request #6 from cicku/main",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-27T10:55:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6104575ab7e141002289d11a588bd70fb39b804a",
"body": "security: small fixes + new release",
"is_bot": false,
"headline": "Merge pull request #8 from kushaldas/update",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-27T10:43:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "acb7f62b70f82f4030d6ae838758ec5211cf602c",
"body": null,
"is_bot": false,
"headline": "fix: CI action updates",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-27T10:37:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9d8811fdb0cf9f425086e2322991a6132d1521f2",
"body": "Bump the crate version to 0.4.0 and add CHANGELOG.md for the security\nhardening release.\n\nThis release fails closed on ambiguous PKCS#11 token and object\nselection, adds explicit PKCS#11 selection helpers, rejects high-level\nPKCS#11 AES-CBC, tightens DH and KDF validation, rejects 3DES IV-only\nciphertext, and refreshes compatible dependency versions.",
"is_bot": false,
"headline": "release: bump kryptering to 0.4.0",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-27T10:18:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "21527ecaa9a57f98b79b7f88c76db2524cb46fb0",
"body": "fix compilation on windows",
"is_bot": false,
"headline": "Merge pull request #4 from lmikoc/fix-windows-compilation",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-01T12:10:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a894ac5b88220fb917049d01514f71a35ddea147",
"body": null,
"is_bot": false,
"headline": "fix: clippy",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-01T12:04:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df16c21f22d9a766b5a375e0db72e11601d9d856",
"body": "Take the post-quantum pre-release wave now that finals have shipped.\nThese three move together (they must agree on the same pkcs8 0.11,\nsignature 3, and digest 0.11 lines):\n\n ml-dsa =0.1.0-rc.8 -> 0.1.0 (stable final)\n pkcs8-pq =0.11.0-rc.11 -> 0.11.0 (stable final)\n slh-dsa 0.2.0-rc\n[…]\nlt, no-default, post-quantum, legacy\n - cargo test --all-features --lib: 96 pass\n - cargo clippy --all-features --all-targets -- -D warnings: clean\n - cargo audit --deny warnings: exit 0 (155 deps)",
"is_bot": false,
"headline": "deps: bump post-quantum crates to finals; refresh compat patches",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-01T12:03:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6277df287effbcc7b604e8913d609f6033837472",
"body": "deps: bump post-quantum crates to finals; refresh compat patches",
"is_bot": false,
"headline": "Merge pull request #7 from kushaldas/feat/new_release",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-01T11:54:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9b4517e399a7a080500fd8434a2e7d5086305157",
"body": "Take the post-quantum pre-release wave now that finals have shipped.\nThese three move together (they must agree on the same pkcs8 0.11,\nsignature 3, and digest 0.11 lines):\n\n ml-dsa =0.1.0-rc.8 -> 0.1.0 (stable final)\n pkcs8-pq =0.11.0-rc.11 -> 0.11.0 (stable final)\n slh-dsa 0.2.0-rc\n[…]\nlt, no-default, post-quantum, legacy\n - cargo test --all-features --lib: 96 pass\n - cargo clippy --all-features --all-targets -- -D warnings: clean\n - cargo audit --deny warnings: exit 0 (155 deps)",
"is_bot": false,
"headline": "deps: bump post-quantum crates to finals; refresh compat patches",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-06-01T10:42:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4b2469f08405b0735bb6fd890345b8f97c4a3a21",
"body": "The `cryptoki` dep used by the `pkcs11` feature pulls in `cryptoki-sys`,\nwhich in turn depends on `libloading`. `libloading` is gated on\n`#[cfg(any(unix, windows, libloading_docs))]` and cannot be built for\n`wasm32-unknown-unknown`.",
"is_bot": false,
"headline": "Gate PKCS#11 backend on non-wasm32 targets",
"author_name": "ᴄʜʀɪsᴛᴏᴘʜᴇʀ ᴍᴇɴɢ",
"author_login": "cicku",
"committed_at": "2026-05-15T05:50:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "67523b9a8b74d34de318547dbf7b918703345bbe",
"body": null,
"is_bot": false,
"headline": "fix compilation on windows",
"author_name": "Luka Mikoc",
"author_login": "lmikoc",
"committed_at": "2026-05-12T18:26:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "91613d83f619dc6ee7842b526cb60eb50705ab69",
"body": "feat(post-quantum): add generate_ml_dsa helper",
"is_bot": false,
"headline": "Merge pull request #3 from kushaldas/021",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T12:18:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "88e7e4466a8c08eb56d910a8edc3f4b8ff430810",
"body": "getrandom::fill may partially fill the buffer before returning an\nerror; the previous map_err()? path dropped seed_bytes without\nwiping it. Switch to an explicit check that zeroizes the stack\nbuffer before propagating the error, matching the zeroization\nguarantee in the doc comment.",
"is_bot": false,
"headline": "fix(post-quantum): zeroize seed on getrandom failure",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T12:13:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d2de5d9b100be045837ec0cc6739bf4e36b0b853",
"body": "- generate_ml_dsa now zeroizes the seed on every exit path: copy into\nprivate_der immediately after getrandom::fill, wipe seed_bytes, then\nwrap the fallible seed-construction + SPKI-encode in a closure and\nexplicitly zeroize private_der on any error before propagating.\n- Replace .expect on ml_dsa::S\n[…]\n marker, not a Zeroize impl.\n- Drop the [`load_ml_dsa_signing_key`] intra-doc link that broke\ncargo doc --all-features under -D warnings (the link points at a\nprivate item; replaced with plain prose).",
"is_bot": false,
"headline": "fix(post-quantum): address PR #3 review comments",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T11:54:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b98d25ae94bc70ece89d86aff5a7d1ec625ed6bc",
"body": "Returns a SoftwareKey::PostQuantum with a freshly generated 32-byte\nFIPS 204 seed (private_der) and the SPKI DER verifying key\n(public_der). Entropy comes from getrandom::fill, matching the\nsigning path's getrandom::SysRng so the crate has a single\npost-quantum RNG policy.\n\nRe-exported at crate root under the post-quantum feature. Two tests\ncover the round-trip across all three variants (ML-DSA-87 on an\n8 MiB thread) and seed uniqueness between successive calls.",
"is_bot": false,
"headline": "feat(post-quantum): add generate_ml_dsa helper",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T11:34:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cc0e540b8cd260bc46af89bf1bbffa87c899fe9e",
"body": "ML-DSA",
"is_bot": false,
"headline": "Merge pull request #2 from kushaldas/ml-dsa",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T09:24:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b7bc25862ce7a4af6e78851de3f09ecaa5cf4029",
"body": null,
"is_bot": false,
"headline": "fix: source comment",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T09:20:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "83114eb5009e0dd90714a0664cdd3fe840155aa9",
"body": "Four follow-ups from PR #2 review (Copilot):\n\n1. Cargo.toml: make `getrandom = 0.4` optional and pull it in via the\n`post-quantum` feature (`dep:getrandom`). `SysRng` is only touched\nfrom `pq_ml_dsa_sign`, so non-PQ builds no longer drag in\ngetrandom 0.4 and its WASI transitive set. Verified with bu\n[…]\nzero\" with an\naccurate statement that non-PQ builds see zero delta from the RNG\nchoice itself, and PQ builds already accept the getrandom 0.4 +\nml-dsa 0.1.0-rc.8 upgrades present elsewhere in this PR.",
"is_bot": false,
"headline": "fix: updates based on review",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T09:10:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5a0eeb90f15115db786f972aa271eb140ae30b45",
"body": "CKM_AES_GCM allows the PKCS#11 library to overwrite the caller-supplied\nIV buffer with the value actually used for encryption. The previous\ncode built `GcmParams` from a local `iv_buf` copy of `nonce` and then\nprefixed the wire output with `nonce` (the pre-call value), so any\ntoken that rewrote the \n[…]\n IVs (SoftHSM2, most software tokens) the post-call\nvalue equals the generated value, so existing behaviour is preserved\nbyte-for-byte; on strict tokens that overwrite, the wire format is\nnow correct.",
"is_bot": false,
"headline": "fix(pkcs11): serialize post-call AES-GCM nonce",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T08:51:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f96a71ce5975d6cb58036d6c3e8712d09c741674",
"body": null,
"is_bot": false,
"headline": "chore: deps update",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T07:27:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "332519659243d40564b1fb13ae71050dab401e31",
"body": "cryptoki 0.12.0 drops its `paste` dependency and switches `AuthPin` to\nsecrecy::SecretString, which also gives us automatic zeroization of the\nPIN buffer held by the library. As a side-effect the RUSTSEC-2024-0436\nallow-list entry becomes unnecessary and is removed from\n.cargo/audit.toml; the remain\n[…]\nchanged to\n (iv: &mut [u8], aad: &[u8], tag_bits: Ulong) -> Result<_, Error>\n Both encrypt and decrypt paths now copy the nonce into a local\n [u8; 12] scratch buffer and `?` the result.",
"is_bot": false,
"headline": "deps(cryptoki): bump 0.7 -> 0.12 and drop paste advisory ignore",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T07:10:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "af6e2a89ec44075861fbe45a4a226b4a317d19fe",
"body": null,
"is_bot": false,
"headline": "add: ml-dsa advisory posture",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T06:52:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a2e8512a252c8406fd60bd16d14da5bf80b04817",
"body": "Bump ml-dsa 0.1.0-rc.7 -> 0.1.0-rc.8 and replace sign_deterministic\nwith sign_randomized seeded from getrandom::SysRng. Deterministic\nML-DSA is vulnerable to fault-injection attacks that recover bits of\nthe secret vectors by diffing a faulted signature against a clean one\non the same message (Bruind\n[…]\nfor the same fork-safety and memory-hygiene\nreasons (signature 2.2.0 still requires rand_core 0.6 traits that\nSysRng does not satisfy). Docs/adr/0001-rng-choice.md records the\nrationale and the split.",
"is_bot": false,
"headline": "add(ml-dsa): switch to randomized signing via getrandom::SysRng",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-23T06:37:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f61c94a21b661cffd681e78ea38fc803b488292f",
"body": null,
"is_bot": false,
"headline": "fix: add audit notes",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T20:36:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b98053747a8d77f9e6e48dfe2276eeeeff4f976d",
"body": "Also has `cargo fmt` fixes.",
"is_bot": false,
"headline": "ci: add github actions workflows",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T20:25:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "75632e3b1deaa62179eeed863843cdca77a35165",
"body": "Non-breaking low-severity cleanups. No production behaviour change\nfor the happy paths; rejection / fallback paths get tighter.\n\nChanges:\nL-01 src/digest.rs: raw_to_pXXX_sig (P-256/P-384/P-521) now gates\n the DER probe on `first() == 0x30 && len > FIELD*2`. A DER\n parse failure falls through to n\n[…]\n\nhappens to start with 0x30 (bounded ~256 tries), then asserts the\n64-byte raw parser accepts it via the equal-length fast branch. The\nsame code path covers the P-384 / P-521 variants by construction.",
"is_bot": false,
"headline": "fix: ECDSA DER heuristic, PKCS#11 init tolerance, misc doc/asserts",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T20:25:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e59be7e20de396b6060c41dac50291c1c365854b",
"body": "Non-breaking additions + targeted hardening. Existing callers unaffected;\nbergshamra dsig/enc suites stay at 447/0/3 and 701/0/0.\n\nChanges:\nM-03 SoftwareSigner/Verifier: new_with_pq_context() threads a\n FIPS 204/205 context into ML-DSA/SLH-DSA. Old new() stays and\n delegates with &[]. pq_*_dispat\n[…]\n SoftwareKey::Hmac(Vec::new()) rejected at signer/verifier\n construction.\nM-11 Confirmed no code change needed -- H-01 already harmonised\n unsupported-OAEP-hash errors across software and PKCS#11.",
"is_bot": false,
"headline": "fix: multiple medium level",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T20:25:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a3a1467b3367ac23a3bf3899bb41ae2cb362df8c",
"body": "ed25519_verify called VerifyingKey::verify, which follows the more\npermissive of RFC 8032's verification rules. verify_strict enforces\nthe strict rules (canonical R encoding, low-order R rejection,\ncanonical s encoding). Callers that treat the signature bytes\nthemselves as unique identifiers -- cons\n[…]\nd25519_rejects_low_order_r: constructs a 64-zero-byte\nsignature (R = identity point, s = 0) and asserts it fails\nthrough SoftwareVerifier. Pins the strict behaviour so a\nfuture revert is caught in CI.",
"is_bot": false,
"headline": "fix(sign): use Ed25519 verify_strict to close malleability surface",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T20:25:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f718cf204715abe0e5c9709d3bbcee37479db4af",
"body": "NIST SP 800-56B Rev. 2 and modern IETF guidance treat SHA-1 as\ndeprecated for RSA-OAEP. The previous OaepConfig::default() returned\nSHA-1 / SHA-1 to ease XML-Enc 1.0 rsa-oaep-mgf1p interop, but that's\na lowest-common-denominator default that biases new callers toward\na weakened configuration without\n[…]\nng tests that used ::default() without caring about\nthe specific hash (test_rsa_oaep_with_label,\ntest_rsa_oaep_wrong_key_fails) now exercise the SHA-256 path --\nwhich is the desired forward direction.",
"is_bot": false,
"headline": "fix(algorithm): default OaepConfig to SHA-256 instead of SHA-1",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T20:24:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cd04fe30c82846e3ce68eab2630ef80108b65bfd",
"body": "H-07 set PBKDF2_MIN_SALT_LEN=16 and PBKDF2_MIN_ITERATIONS=1000 per\nNIST SP 800-132. Those are NIST-profile requirements, not primitive\ncorrectness bounds -- RFC 8018 (the actual PBKDF2 spec) treats both\nas SHOULD-level recommendations. Enforcing them at the primitive\nlayer broke W3C XML Encryption 1\n[…]\nalt.is_empty(), key_length == 0, and\nkey_length > 1 MiB still error.\n- Pbkdf2Params::recommended continues to encode OWASP 2023\n(SHA-1 1 300 000 / SHA-256 600 000 / SHA-384 310 000 /\nSHA-512 210 000).",
"is_bot": false,
"headline": "fix(kdf): relax PBKDF2 policy floors, keep the real bug rejections",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T20:24:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "523aa2ae3f8d7ec3c4c3ee75b574bcb78c5af89b",
"body": "We removed keyagreement::dh_compute because num_bigint_dig's\nmodpow was variable-time on the private exponent. That removal broke the\nbergshamra XML Encryption 1.1 DH-ES path (RFC 5114 Group 3, 2048-bit p,\n256-bit q). Restore the function with a constant-time-on-pattern\nimplementation backed by cryp\n[…]\nivate: &[u8],\n\t p: &[u8], q: Option<&[u8]>) -> Result<Vec<u8>>\nso downstream bergshamra updates one import line per call site:\nkryptering::keyagreement::dh_compute -> kryptering::hazmat::dh::compute",
"is_bot": false,
"headline": "feat(hazmat): restore X9.42 DH with constant-time-on-pattern modpow",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T17:29:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2791a20024997066b4a70824f95241d99dd0c95b",
"body": "pbkdf2_derive previously accepted iteration_count: 0 and empty salts\nsilently, producing trivially-brute-forceable keys. Now rejects:\n- salt < 16 bytes (SP 800-132 5.1)\n- iteration_count < 1000 (SP 800-132 5.2)\n- key_length == 0 or > 1 MiB\n\nExpose the floors as PBKDF2_MIN_SALT_LEN, PBKDF2_MIN_ITERAT\n[…]\nation counts (1.3M / 600k /\n310k / 210k for SHA-1/256/384/512).\n\nBehavioural break: existing callers using <16-byte salts or <1000\niterations will now see Error::Crypto at runtime. That is the intent.",
"is_bot": false,
"headline": "fix(kdf): enforce NIST SP 800-132 floors on PBKDF2 params",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T17:07:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4e891cdfc622aaec37feab111145af21e753c807",
"body": "Private key material held by SoftwareKey persisted in the heap (and\nfor X25519, on the stack) until the allocator overwrote it. A process\nthat performed a single signing / ECDH / HMAC operation would leave\nrecoverable key bytes in freed pages for the remainder of the process\nlifetime -- swap, core d\n[…]\n footprint of\nits own, and the pin.into() allocation transfers ownership directly\ninto the SecretString. The original finding's concern about a\nkryptering-internal residual copy is mitigated upstream.",
"is_bot": false,
"headline": "fix(key): zeroize SoftwareKey private and X25519 stack",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T16:53:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5d98dfd163de01fac7c053e9667369eee1a11599",
"body": "AES-CBC with PKCS#7 / xmlenc unpadding is a padding oracle when exposed\nas a public decrypt API that returns distinguishable errors for bad\npadding vs bad ciphertext. Vaudenay / Bleichenbacher-in-CBC attacks\nrecover plaintext from any remote caller willing to respond differently\nto the two condition\n[…]\nte)) since legacy 3DES-CBC and hazmat\nboth still use them.\n- src/lib.rs: pub mod hazmat.\n- README.md: Ciphers row now reads\n\"AES-GCM, AES-CBC (hazmat, unauthenticated -- kryptering::hazmat::aes_cbc)\".",
"is_bot": false,
"headline": "add: hazmat move unauthenticated AES-CBC out",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T16:41:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fc268ca2f6b8dcd02416d46578bb60778413ac90",
"body": "ecdh_x25519 previously returned whatever shared secret x25519-dalek\nproduced, including the all-zero output that results from a low-order\npeer public key. RFC 7748 section 6.1 flags this check as MAY, but any\nprotocol that feeds the shared secret into a KDF and then authenticates\nwith the derived ma\n[…]\ns do not have to remember.\n\nThe x25519-dalek SharedSecret type already exposes was_contributory(),\nwhich returns true iff the output is not the identity. Use it and\nreturn Error::Key when it is false.",
"is_bot": false,
"headline": "fix(keyagreement): reject X25519 low-order peer public keys",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T16:30:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8b28d444b8db2363efdf1c3b84f4b26c2b392354",
"body": "dh_compute performed the shared-secret computation as\npub_uint.modpow(&priv_uint, &p_uint)\nusing num_bigint_dig::BigUint, whose modpow is variable-time with\nrespect to the exponent. Since the exponent is the long-term DH\nprivate key, a colocated or networked attacker with timing visibility\ncould rec\n[…]\nth remain reachable\ntransitively via the dsa crate under the legacy feature, so the\nDSA signing path still compiles.\n- README.md: remove \"DH (X9.42)\" from the Key agreement row of the\nalgorithm table.",
"is_bot": false,
"headline": "remove(keyagreement): drop timing-unsafe finite-field DH (X9.42)",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T16:25:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9a97a5323674745b181faaa96f7acf22b0675101",
"body": "The oaep_encrypt and oaep_decrypt macros previously ran the caller-supplied\nlabel through String::from_utf8_lossy before handing it to rsa::Oaep. Any\nbyte that was not valid UTF-8 was silently replaced with U+FFFD, which meant\ntwo distinct binary labels could collide after the lossy conversion. That\n[…]\n oaep_encrypt! and oaep_decrypt! macros to use the helper.\nRemoves both String::from_utf8_lossy calls.\n- Update kt_encrypt and kt_decrypt public doc comments to document the\nUTF-8 constraint up-front.",
"is_bot": false,
"headline": "fix(keytransport): reject non-UTF-8 OAEP labels",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T16:19:50Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d1d93b7ce3fb4a03f7457c5b929bdd3550f1715f",
"body": "Both OAEP dispatch macros had catch-all `_` arms that fell through to\nsha1::Sha1 when the digest or MGF1 hash was not in the explicit match\nlist. Passing HashAlgorithm::Sha3_* silently produced SHA-1 OAEP while\nthe caller believed they had asked for SHA-3. The PKCS#11 backend\nalready rejected the sa\n[…]\n on\nwhich configurations were valid.\n\nReplace all four catch-alls with\n`other => Err(Error::UnsupportedAlgorithm(...))` in both the outer\ndigest match and the inner MGF match, for encrypt and decrypt.",
"is_bot": false,
"headline": "fix(keytransport): reject unsupported OAEP hashes",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T16:16:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "895bd5df6624d268d25bde699d4af0bf68c2b97a",
"body": "The previous implementation of constant_time_eq accepted caller-truncated\ninputs: when the submitted signature `b` was shorter than the expected MAC\n`a`, only the first b.len() bytes of `a` were compared. This was intended\nto support \"truncated HMAC\" but the truncation length was entirely under\natta\n[…]\n so the equal-length path remains\nconstant-time for a fixed length.\n- Expand the doc comment to document the prior bug so it does not\nget reintroduced by a well-meaning \"support truncated MACs\" patch.",
"is_bot": false,
"headline": "fix(digest): reject length mismatch in constant_time_eq",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-22T16:12:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c116aa20f754f22d8282158a5015b83823015c92",
"body": null,
"is_bot": false,
"headline": "feat: intial commit for public release",
"author_name": "Kushal Das",
"author_login": "kushaldas",
"committed_at": "2026-04-02T10:39:07Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 6,
"commits_last_year": 58,
"latest_release_at": "2026-07-23T07:42:36Z",
"latest_release_tag": "v0.5.0",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 10,
"days_since_latest_release": 0,
"mean_days_between_releases": 18.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": false,
"has_contributing": false,
"health_percentage": 28,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "kryptering",
"exists": true,
"license": "BSD-2-Clause",
"keywords": [
"cryptography",
"pkcs11",
"hsm",
"signing",
"rustcrypto",
"authentication",
"cryptography"
],
"ecosystem": "crates",
"matches_repo": true,
"registry_url": "https://crates.io/crates/kryptering",
"is_deprecated": false,
"latest_version": "0.5.0",
"repository_url": "https://github.com/kushaldas/kryptering",
"versions_count": 7,
"total_downloads": 25466,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": 8345,
"first_published_at": "2026-04-02T10:44:23.104182Z",
"latest_published_at": "2026-07-23T07:42:24.117370Z",
"latest_version_yanked": false,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 2,
"stars": 1,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-05-12",
"count": 1
},
{
"date": "2026-07-11",
"count": 1
}
],
"complete": true,
"collected": 2,
"total_forks": 2
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"Cargo.toml"
],
"largest_source_bytes": 58427,
"source_files_sampled": 32,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"Cargo.toml"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"crates"
],
"dependencies": [
{
"name": "thiserror",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "2"
},
{
"name": "digest",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.10"
},
{
"name": "sha1",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.10"
},
{
"name": "sha2",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.10"
},
{
"name": "sha3",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.10"
},
{
"name": "hmac",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.12"
},
{
"name": "rsa",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.9"
},
{
"name": "ecdsa",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.16"
},
{
"name": "dsa",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.6"
},
{
"name": "p256",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.13"
},
{
"name": "p384",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.13"
},
{
"name": "p521",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.13"
},
{
"name": "aes",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.9"
},
{
"name": "cbc",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.2"
},
{
"name": "aes-gcm",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.11"
},
{
"name": "aes-kw",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.3"
},
{
"name": "ed25519-dalek",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "2.1"
},
{
"name": "ed448-goldilocks",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "=0.14.0-pre.15"
},
{
"name": "x25519-dalek",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "2.0"
},
{
"name": "hkdf",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.12"
},
{
"name": "pbkdf2",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.12"
},
{
"name": "signature",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "2"
},
{
"name": "rand",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.8"
},
{
"name": "zeroize",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "1.7"
},
{
"name": "pkcs8",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.10"
},
{
"name": "crypto-bigint",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.7"
},
{
"name": "aws-lc-rs",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "1.17"
},
{
"name": "rustls",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.23.42"
},
{
"name": "md-5",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.10"
},
{
"name": "ripemd",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.1"
},
{
"name": "des",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.9"
},
{
"name": "ml-dsa",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.1.0"
},
{
"name": "slh-dsa",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.2.0-rc.5"
},
{
"name": "ml-kem",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.3.2"
},
{
"name": "pkcs8-pq",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.11.0"
},
{
"name": "getrandom",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.4"
},
{
"name": "generic-array",
"manifest": "Cargo.toml",
"ecosystem": "crates",
"version_constraint": "=0.14.7"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 11,
"open_issues": 0,
"closed_ratio": 1,
"closed_issues": 2,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "kushaldas",
"commits": 59,
"avatar_url": "https://avatars.githubusercontent.com/u/272303?v=4"
},
{
"type": "User",
"login": "lmikoc",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/94833809?v=4"
},
{
"type": "User",
"login": "cicku",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/686438?v=4"
}
],
"contributors_sampled": 3,
"top_contributor_share": 0.967
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"audit.yml",
"ci.yml",
"publish.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"Cargo.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 8,
"reason": "8 out of 9 merged PRs checked by a CI test -- score normalized to 8",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 2,
"reason": "Found 2/9 approved changesets -- score normalized to 2",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 4 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 10,
"reason": "all dependencies are pinned",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "cb733df24eec02bc548547fb2c51f9987180ba34",
"ran_at": "2026-07-23T11:56:13Z",
"aggregate_score": 5.2,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-23T07:43:02Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-23T07:36:10Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/kushaldas/kryptering",
"host": "github.com",
"name": "kryptering",
"owner": "kushaldas"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"security": 52,
"vitality": 81,
"community": 34,
"governance": 67,
"engineering": 64
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 81,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 69,
"inputs": {
"commits_last_year": 58,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 10
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "10/52 weeks with commits",
"points": 6.9,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 10
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "58 commits in the last year",
"points": 15.9,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 58
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 6,
"latest_release_tag": "v0.5.0",
"releases_from_tags": false,
"days_since_latest_release": 0,
"mean_days_between_releases": 18.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "6 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 6
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~18.2 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 18.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 34,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 2,
"stars": 1,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "1 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 1
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "2 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 2
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (BSD-2-Clause)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "BSD-2-Clause"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 65,
"inputs": {
"packages": [
"kryptering"
],
"dependents": null,
"ecosystems": "crates",
"total_downloads": 25466,
"monthly_downloads": 8345
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "8,345 downloads/month across crates",
"points": 52.3,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 8345,
"ecosystems": "crates"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 67,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 24,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 3,
"top_contributor_share": 0.967
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 97% of commits",
"points": 0.7,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 97
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "3 contributors",
"points": 4.1,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 3
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 4 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "excellent",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 88,
"inputs": {
"merged_prs": 11,
"open_issues": 0,
"closed_issues": 2,
"issue_closed_ratio": 1,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "100% of issues closed",
"points": 46.8,
"status": "met",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 100
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "11/11 decided PRs merged",
"points": 38.2,
"status": "met",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 11,
"decided": 11
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 2/9 approved changesets -- score normalized to 2",
"points": 3,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 70,
"inputs": {
"followers": 943,
"owner_type": "User",
"is_verified": null,
"owner_login": "kushaldas",
"public_repos": 225,
"account_age_days": 5917
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "943 followers of kushaldas",
"points": 21.4,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 943,
"login": "kushaldas"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "225 public repos, account ~16 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 225
}
},
{
"code": "account_age_years",
"params": {
"years": 16
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"kryptering"
],
"ecosystems": "crates",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on crates",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "crates"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "7 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 7
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 64,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "3 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 3
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "8 out of 9 merged PRs checked by a CI test -- score normalized to 8",
"points": 16,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 52,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 52,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 5.2
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "8 out of 9 merged PRs checked by a CI test -- score normalized to 8",
"points": 2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 2/9 approved changesets -- score normalized to 2",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 4 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 7
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 63,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.984,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "60 of 61 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 60,
"sampled": 61
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 66,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"Cargo.lock"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"Cargo.toml"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Cargo.toml (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "Cargo.toml"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Rust (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Rust"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 61",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 61
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "all dependencies are pinned",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Rust",
"largest_source_bytes": 58427,
"source_files_sampled": 32,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Rust (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Rust"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/32 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 32,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"deps.dev does not index crates:kryptering@0.5.0; advisories assessed against the repository dependency graph instead"
],
"report_type": "repository",
"generated_at": "2026-07-23T11:56:28.367525Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/k/kushaldas/kryptering.svg",
"full_name": "kushaldas/kryptering",
"license_state": "standard",
"license_spdx": "BSD-2-Clause"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with kushaldas/kryptering. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
