Bodo, the TrustScope mascotTrustScope
Adopter

Before you depend on a project, know how far to trust it.

Secure, well-governed, and still maintained next year? Check any repo before you take on the dependency.

Maintaining your own project instead? TrustScope for maintainers

  • Made in Germany
  • GDPR-clean
  • No tracking
  • No sign-in
  • Open source

Who does what — and why

You — the adopter

Evaluating a third-party library, framework or tool before you take on the dependency.

TrustScope — reads the repo

Runs the full OpenSSF Scorecard and reads three pillars separately — never averaging the trade-offs away.

You — decide, then act

Adopt, proceed with caution, or avoid — and file constructive fixes upstream, as yourself.

How TrustScope helps

Three questions, answered separately — so the trade-off you're weighing stays visible instead of collapsing into one grade.

Pillar 1

Security & Supply Chain

Is it built securely?

The full OpenSSF Scorecard — where the xz pattern hides.

Pillar 2

Trust & Governance

Can I trust the project behind it?

Ownership, licensing & security policy.

Pillar 3

Community & Sustainability

Will it be here in a year?

Activity & contributor lifecycle.

No single aggregate score. A verdict per pillar — the decision stays yours.

AdoptProceedAvoid

Frequently asked

What does TrustScope do for adopters?+
It assesses a third-party open-source project before you depend on it, reading three pillars separately — Security & Supply Chain, Trust & Governance, and Community & Sustainability — so you can decide adopt, proceed, or avoid.
How is this different from a star count or a green badge?+
Stars and badges signal popularity, not risk. TrustScope reads the full OpenSSF Scorecard plus governance and community signals, and keeps the trade-offs visible instead of averaging them into one number.
What is the "xz pattern", and how does TrustScope surface it?+
The xz backdoor showed how supply-chain risk stays invisible until it detonates. The Security & Supply Chain pillar reads the full Scorecard signals so the risk is legible before you take the dependency.