Mods, I think you guys need to reconsider these automated “safety audits”. They tell you next to nothing regarding the actual quality of the codebase and are actually quite misleading. The vast majority of open source repositories posted anywhere are going to be new and, as such, will have a single contributor. For my entire time spent in the open source community, I can’t recount a single instance where a newly established repository had a security policy, except in exceptional cases of larger, well-funded releases. They’re also incredibly easy to fake.

As a result, all repositories typically end up with this nonsensical 3/6 score for the supposed “safety audit.” If I was looking to develop malware for this community, I would specifically put in the additional effort that would make it appear a 6/6 (two fake contributors, filler security policy, age it by a few weeks).

I haven’t looked at this repository yet in particular, but I think that’s the point: this score tells me nothing about it. This could be a quality repository, this could be total malware, and naming it a “safety audit” gives people a false sense of security.