We test what you're about to run.
Not just what it claims to do.
Every repo here is checked against 14 real vulnerability classes, signed, and hash-pinned to the exact commit we tested — before you ever see a tier badge.
Repos published
Vulnerability classes checked
Signed & hash-pinned
Repos Publicly exploit-mapped
Our Process
How a repo gets vetted
Scan
We run smartcvescan's 14-class reachability analysis against the exact pinned commit.
Classify
Every candidate is scored R0–R3 by whether untrusted input can actually reach it — not just whether the pattern exists.
Sign & Publish
The attestation is cryptographically signed and hash-pinned to the source archive, then published with full evidence.
Re-vet
We recheck on a schedule and whenever upstream moves, so a clean verdict doesn't go stale silently.
Measured, not assumed
Every result records how it was determined. A class we didn't test says "Not tested," never a green check.
Reachability, not presence
Finding a risky function means little alone. What matters is whether untrusted input can actually reach it.
Behavior, not defect
Agent-reachable ≠ vulnerable. We keep context-dependent properties visibly separate from confirmed findings.
Containment is the control
We measure what software actually reaches at runtime, so blast radius can be bounded regardless of code perfection.
Honest about limits
"None reachable" means "none found in our tested scope" — not "provably impossible."
Integrity you can check
Every attestation is signed and pinned to an exact commit and archive hash. Tampering is detectable.
Comparison
How this differs from a star count or a badge
| Feature | Smarttasks.Cloud | GitHub stars | Package registries | Static badges |
|---|---|---|---|---|
| Evidence-backed, not just popularity | — | — | — | |
| Reachability-scored, not pattern-matched | — | — | — | |
| Signed & hash-pinned to an exact commit | — | — | — | |
| Re-checked as upstream changes | — | — | ||
| Shows what wasn't tested, honestly | — | — | — |
Want a repo vetted?
Request a repo and we'll queue it for the next vetting pass.
Every attestation is signed and hash-pinned to a real commit.