free
Free checks
Three checks you can run in a minute. Each one says what it looked at, and each one says what it cannot tell you.
The three checks
Eight security signals in a GitHub repository
Name a public repository and see which of eight selected signals, related to topics in the EU Cyber Resilience Act, are visible in it: a security policy that names a contact, an SBOM, proof of where releases come from, a lockfile, automatic updates, a security scan, recent maintenance and a licence. It reads public pages only and stores no report.
Free x402 endpoint check
Paste the URL of an x402 route you run and see, from one anonymous request that never pays, whether the payment request passes the official buyer schema and how far up the receipt ladder it gets. No result is stored.
Prove you own an endpoint
A free, live check that an endpoint is yours, without an account.
What we measured
109 public repositories, eight signals each, measured on 28 October 2026. The grids come from rule set 2026-10-28.6; the check now runs a newer one that also reads other CI systems, so a new run can give other numbers.
- visible
- not visible
- not measured
- your repository, not in the measurement
One square is one repository, sorted by result inside each grid. The same place in two grids is not the same repository.
Measured 2026-10-28, 109 repositories, rule set 2026-10-28.6. Read the note with the method
Show as a table| Signal | visible | not visible | not measured |
|---|---|---|---|
| Security policy with a contact | 17 | 89 | 3 |
| Software bill of materials (SBOM) | 4 | 97 | 8 |
| Proof of where a release comes from | 5 | 96 | 8 |
| A lockfile is present | 56 | 24 | 29 |
| Automatic dependency updates | 36 | 70 | 3 |
| Security scan in a GitHub Actions workflow | 15 | 89 | 5 |
| A commit in the last 90 days | 88 | 21 | 0 |
| A licence | 85 | 24 | 0 |
How a log you can verify works
This is how a log works that you can verify without trusting us. Every line holds the hash of the line before it, so changing, removing or reordering an old line shows to anyone who kept an earlier head of the log. Our Signal log works this way, and the timestamp of its head comes from OpenTimestamps, which is outside our control.
Change a character. Watch the chain break.
- 1 Line 1
4883f344e4916933dac99b8d sealed
- 2 Line 2
5622f91660520e3cf004faaf sealed
- 3 Line 3
ebdbb407551c78d9f3737b24 sealed
- 4 Line 4
14b1b212ffcd4e65c15b1a41 sealed
Every line still matches what was sealed.
Illustration with made-up lines, not our log. The hashes are real SHA-256, computed in your browser.
Our smart contract scan was tested on a sealed set of audit contests. The set was committed by its hash before the run, so anyone can recompute that hash. The new version did not meet the bar we set beforehand. See the scoreboard
What they are not
The repository check is not a conformity assessment and not legal advice: eight signals are a selection and not one per legal requirement. A signal that is not visible may exist elsewhere.
Want it every week
The Signal log runs the repository check weekly and writes each result into a log with a timestamp you can check without us.