free
Which security signals can be seen in your GitHub repository? Free, live, a repository name is enough.
Name a public GitHub repository. Our server reads a handful of its public pages, up to about thirty small requests, and tells you which of eight selected signals are visible: a security policy that names a contact, a software bill of materials, proof of where releases come from, a lockfile, automatic updates, security scans, recent maintenance and a licence. For each signal that is not visible you get what would make it visible, and a signal we could not read completely is marked as not measured, never as a gap.
The EU Cyber Resilience Act (Regulation 2024/2847) puts duties on makers of software that is sold in the EU. The reporting duties of Article 14 apply from 11 September 2026, the rules on conformity assessment bodies from 11 June 2026 and most other duties from 11 December 2027. From outside you cannot see where a team stands, and most of what the Regulation asks is not visible from outside. These eight signals are our selection: some relate to Annex I part II of the Regulation, others are general good practice. They are not one signal for each legal requirement, and they do not tell you whether you comply.
We do not store reports. An answer is kept in server memory for up to an hour (five minutes when part of it could not be read) so that the same repository is not read twice, and the server logs no repository names. Only public repositories can be checked, and a private repository looks the same as one that does not exist.
Your repository
A public repository on github.com, as owner/name or its address.
RepositoryWhy this exists: we ran the same check on our own repositories first. One of them showed four signals that were not visible (no security policy, no automatic updates, no security scan, no software bill of materials), we added them, and the check now shows all eight as visible.
An indication from public data about eight selected signals is all this is. It is not a check against the legal requirements, not a conformity assessment, not legal advice, and not a certificate.