FREE TOOL

Software Supply Chain Trust Scorecard

Evaluate software supply chain maturity across artifact integrity, dependency governance, and CI/CD hardening. You receive an instant score, top gaps, and 30-day actions.

Methodology is published as a community resource under MIT: view rubric.

Checking scoring API...

Release artifacts are cryptographically signed. Build provenance attestations are generated and stored. SBOMs are generated for all production releases. Critical dependencies are version pinned and reviewed. Dependency updates for high-risk packages follow an SLA. CI runners are isolated and hardened for untrusted code. CI/CD secrets are rotated and scoped with least privilege. Builds run from trusted, protected branches only. Security review is part of release approval gates. Vulnerability disclosures have documented intake and triage. Critical supply-chain findings are patched quickly. Third-party package/repo risk is tracked continuously. Package maintainers and publishers are verified. Runtime controls detect suspicious package behavior. Supply-chain incident drills are exercised periodically. Leadership receives supply-chain security KPI reporting.

Software Supply Chain Trust Scorecard

Get your detailed supply chain hardening roadmap