# OpenSSF Best Practices Map > [!IMPORTANT] > This file records historical OpenSSF/FLOSS evidence from the project's MIT-licensed period. The current source is licensed under PolyForm Noncommercial 1.0.0 and is source-available, not OSI-approved open source. Do not use this evidence as a current FLOSS-license claim. BadgeApp project: This file preserves the evidence map from the project's earlier MIT-licensed OpenSSF Best Practices self-certification period. It is retained for audit history, not as a statement of current FLOSS eligibility. The BadgeApp entry is owned by the maintainer, so this repository can provide evidence links, but the final `Met`, `Unmet`, or `N/A` selections must be saved by the logged-in project owner. ## How to use this file 1. Open the project in BadgeApp. 2. Complete Passing criteria first. 3. Move to Silver criteria after Passing is achieved. 4. Paste the evidence URL listed below into the criterion URL/comment field, or use the linked document as the supporting evidence. 5. Do not mark a criterion `Met` unless the linked evidence is accurate for the live repository. ## High-priority Passing evidence | BadgeApp criterion | Suggested status | Evidence | | ---------------------------------------- | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `homepage_url` | Met | | | `repo_url` | Met | | | `license` | Met | | | `contribution_requirements` | Met | | | `documentation_interface` | Met | and | | `report_tracker` | Met | | | `vulnerability_report_process` | Met | | | `build` | Met | and | | `test` | Met | and | | `test_continuous_integration` | Met | | | `static_analysis` | Met | | | `static_analysis_common_vulnerabilities` | Met | CodeQL workflow/checks: | | `delivery_mitm` | Met | GitHub and npm HTTPS release channels. | | `no_leaked_credentials` | Met | GitHub secret scanning and push protection are enabled; verified limitations, false-positive handling, and credential response are documented in [Secret Scanning and Credential Response](SECRET_RESPONSE.md). | ## Silver evidence | BadgeApp criterion | Suggested status | Evidence / rationale | | --------------------------------- | ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `achieve_passing` | Met only after BadgeApp shows Passing | | | `dco` | Met | | | `governance` | Met | Ownership, critical-path review, branch protection, automated-finding disposition, and emergency exceptions: | | `code_of_conduct` | Met | | | `roles_responsibilities` | Met | | | `access_continuity` | Met if the offline continuity record exists | | | `bus_factor` | Unmet or justified | The project is intentionally solo-maintained: the bus factor remains one. Continuity evidence: | | `documentation_roadmap` | Met | | | `documentation_architecture` | Met | | | `documentation_security` | Met | and | | `documentation_quick_start` | Met | | | `documentation_current` | Met | CI docs generation and documentation review are part of release gates. | | `documentation_achievements` | Met | README includes the OpenSSF Best Practices badge. | | `accessibility_best_practices` | Met / N/A with explanation | CLI/server project; docs and README use semantic Markdown and image alt text. | | `internationalization` | N/A or unmet with explanation | CLI/server project primarily emits technical English messages; broad i18n is not currently a project goal. | | `sites_password_security` | N/A | Project sites use GitHub/BadgeApp authentication; the project does not store external-user passwords. | | `maintenance_or_update` | Met | | | `vulnerability_report_credit` | Met / N/A | | | `vulnerability_response_process` | Met | | | `coding_standards` | Met | | | `coding_standards_enforced` | Met | CI enforces Prettier, ESLint, TypeScript, tests, an 80% changed-code coverage gate, and the SonarQube Cloud new-code Quality Gate. | | `build_standard_variables` | N/A | TypeScript/npm package; no native compiler/linker build is produced. | | `build_preserve_debug` | N/A | TypeScript/npm package; no native binary stripping process. | | `build_non_recursive` | Met | pnpm/TypeScript build uses project-level scripts rather than recursive native subdirectory builds. | | `build_repeatable` | Met / justify | Eval outputs are written outside tracked files by default; release artifacts are produced by deterministic CI scripts where practical. | | `installation_common` | Met | npm package and `npx easyeda-mcp-pro` setup. | | `installation_standard_variables` | N/A | npm-managed package install; no POSIX-style install path variables are used. | | `installation_development_quick` | Met | | | `external_dependencies` | Met | and | | `dependency_monitoring` | Met | Renovate (sole update-PR bot; see [ADR 0002](./adr/0002-dependency-management.md)), Dependabot alerts, `pnpm audit`, Socket, and CodeQL. | | `updateable_reused_components` | Met | npm/pnpm-managed dependencies and lockfile updates. | | `interfaces_current` | Met | TypeScript strictness, dependency monitoring, and compatibility docs. | | `automated_integration_testing` | Met | | | `regression_tests_added50` | Met / justify | CONTRIBUTING requires regression tests for bug fixes where practical. | | `test_statement_coverage80` | Met | Coverage is tracked through `pnpm test:coverage`; latest local audit exceeded 80% statements. | | `test_policy_mandated` | Met | | | `implement_secure_design` | Met | | | `input_validation` | Met | Zod schemas, MCP tool schemas, config validation, path constraints. | | `crypto_algorithm_agility` | Met / N/A | OAuth/JWKS verification delegates algorithm support to standards-based JOSE/JWKS providers. | | `crypto_credential_agility` | Met | Credentials are supplied through environment variables/secrets, not compiled into code. | | `signed_releases` | Met | Portable Sigstore bundles and in-toto provenance satisfy the project signed-release posture: | | `version_tags_signed` | N/A / documented alternative | GPG-signed tags are not the primary signing mechanism; protected Release Please tags are paired with npm provenance and artifact attestations: | | `hardening` | Met | Security headers, OAuth, tested branch-protection policy, explicit CODEOWNERS, secret scanning, and safe defaults. | | `assurance_case` | Met | | ## BadgeApp helper The file [`scripts/maintainer/openssf-badgeapp-autofill.js`](../scripts/maintainer/openssf-badgeapp-autofill.js) is a best-effort browser-console helper for the logged-in BadgeApp form. It only sets radio values for criteria where evidence is present. Review every value before saving. ## OpenSSF Scorecard Separately from the BadgeApp self-certification above, [`.github/workflows/scorecard.yml`](../.github/workflows/scorecard.yml) runs the [OpenSSF Scorecard](https://github.com/ossf/scorecard) action on every push to `main` and weekly on a schedule. It publishes results to the public Scorecard API (`publish_results: true`) and uploads SARIF findings to GitHub code scanning. The current score is visible on the [Scorecard dashboard](https://scorecard.dev/viewer/?uri=github.com/oaslananka/easyeda-mcp-pro) and via the README badge. Scorecard findings support the `dependency_monitoring`, `static_analysis`, and `hardening` BadgeApp evidence above; review new low-scoring checks when the workflow runs and file follow-up issues for anything actionable.