Awesome Reviewers checks + prompts

Verification leaderboard

The 256 scanned source repositories, ranked by how much of the catalog they run. Each method column is the share of the check kinds that apply to the repository which it actually runs. AVG is the unweighted mean of the method columns. Hard is the same share over rarely run kinds only. The scoring is adapted from VerifyBench; the scoring section says how.

256 repositories
14 hard check kinds (run by under 25% of the repositories they apply to)
leaderboard as JSON
# Repository HygieneStatic analysisSupply chainTestingFormal AVG Hard Kinds run
1 astral-sh/ruff 66.766.7100.080.00.0 62.7 53.8 12/19
2 langfuse/langfuse 66.780.0100.060.00.0 61.3 44.4 10/15
3 prometheus/prometheus 33.360.0100.0100.00.0 58.7 28.6 7/12
4 apache/airflow 100.066.7100.020.00.0 57.3 45.5 10/17
5 tokio-rs/tokio 0.040.0100.080.066.7 57.3 45.5 9/17
6 diegosouzapw/OmniRoute 0.080.0100.0100.00.0 56.0 55.6 10/15
7 jj-vcs/jj 66.750.0100.060.00.0 55.3 41.7 9/18
8 pallets/flask 100.066.750.050.00.0 53.3 50.0 10/16
9 maximhq/bifrost 66.760.0100.040.00.0 53.3 44.4 8/15
10 ruvnet/ruflo 0.060.0100.0100.00.0 52.0 16.7 6/11
11 home-assistant/core 100.066.750.040.00.0 51.3 45.5 10/17
12 mermaid-js/mermaid 33.360.0100.060.00.0 50.7 22.2 8/15
13 zed-industries/zed 33.340.0100.040.033.3 49.3 36.4 7/17
14 maplibre/maplibre-native 66.780.00.0100.00.0 49.3 33.3 8/12
15 prowler-cloud/prowler 66.766.750.060.00.0 48.7 36.4 10/17
16 pydantic/pydantic 100.066.70.075.00.0 48.3 50.0 10/16
17 awslabs/mcp 66.766.750.050.00.0 46.7 30.0 9/16
17 BerriAI/litellm 33.350.050.0100.00.0 46.7 30.0 9/16
17 semgrep/semgrep 66.766.750.050.00.0 46.7 30.0 9/16
20 crewaiinc/crewai 33.350.0100.050.00.0 46.7 20.0 8/16
21 promptfoo/promptfoo 33.360.0100.040.00.0 46.7 11.1 7/15
22 Hmbown/DeepSeek-TUI 33.360.0100.040.00.0 46.7 9.1 7/17
23 langflow-ai/langflow 100.050.00.080.00.0 46.0 36.4 10/17
24 astral-sh/ty 66.760.050.050.00.0 45.3 50.0 7/13
25 tokio-rs/axum 33.340.0100.050.00.0 44.7 16.7 7/18
26 openai/codex 66.720.0100.033.30.0 44.0 16.7 6/18
27 opentofu/opentofu 0.020.0100.0100.00.0 44.0 14.3 4/12
28 celery/celery 100.066.70.050.00.0 43.3 30.0 9/16
29 earendil-works/pi 33.340.0100.040.00.0 42.7 11.1 6/15
30 pola-rs/polars 33.333.350.060.033.3 42.0 23.1 8/19
31 TheAlgorithms/Python 100.033.350.025.00.0 41.7 40.0 7/16
32 open-telemetry/opentelemetry-python 66.766.750.025.00.0 41.7 30.0 8/16
33 astral-sh/uv 33.333.3100.040.00.0 41.3 16.7 6/18
34 prettier/prettier 33.333.3100.040.00.0 41.3 10.0 6/16
35 aaif-goose/goose 33.340.0100.033.30.0 41.3 8.3 6/18
35 block/goose 33.340.0100.033.30.0 41.3 8.3 6/18
35 warpdotdev/warp 33.333.3100.040.00.0 41.3 8.3 6/18
38 gofiber/fiber 33.320.0100.050.00.0 40.7 28.6 4/12
39 Unstructured-IO/unstructured 66.733.350.050.00.0 40.0 20.0 7/16
40 bytedance/deer-flow 33.333.350.080.00.0 39.3 27.3 8/17
41 traefik/traefik 33.360.00.0100.00.0 38.7 14.3 6/12
42 the-pr-agent/pr-agent 33.350.050.050.00.0 36.7 30.0 7/16
43 LMCache/LMCache 66.766.70.050.00.0 36.7 20.0 8/16
44 appwrite/appwrite 33.350.00.0100.00.0 36.7 16.7 4/10
45 openai/codex-security 33.350.050.040.00.0 34.7 18.2 7/17
46 adonisjs/core 33.340.0100.00.00.0 34.7 11.1 4/15
47 neondatabase/neon 33.340.0100.00.00.0 34.7 9.1 4/17
48 can1357/oh-my-pi 33.320.0100.016.70.0 34.0 8.3 4/18
49 github/docs 33.333.30.0100.00.0 33.3 12.5 6/14
50 strands-agents/sdk-python 33.333.350.050.00.0 33.3 10.0 6/16
51 sst/opencode 33.320.00.060.050.0 32.7 20.0 6/16
52 axios/axios 0.040.0100.020.00.0 32.0 22.2 4/15
53 langgenius/dify 33.316.750.060.00.0 32.0 18.2 6/17
54 helix-editor/helix 33.333.30.060.033.3 32.0 16.7 7/18
55 novuhq/novu 0.040.0100.020.00.0 32.0 11.1 4/15
56 bytedance/trae-agent 100.033.30.025.00.0 31.7 20.0 6/16
56 sgl-project/sglang 100.033.30.025.00.0 31.7 20.0 6/16
58 nousresearch/hermes-agent 33.333.350.040.00.0 31.3 18.2 6/17
59 getsentry/sentry 66.750.00.040.00.0 31.3 9.1 7/17
60 microsoft/vscode 33.360.00.060.00.0 30.7 11.1 7/15
60 QwenLM/qwen-code 33.360.00.060.00.0 30.7 11.1 7/15
62 vitessio/vitess 0.050.00.0100.00.0 30.0 16.7 4/11
63 nuxt/nuxt 0.066.70.080.00.0 29.3 30.0 8/16
64 PostHog/posthog 33.333.30.080.00.0 29.3 18.2 7/17
65 browserbase/stagehand 33.340.050.020.00.0 28.7 10.0 5/16
66 python-poetry/poetry 66.750.00.025.00.0 28.3 20.0 6/16
66 python/cpython 66.750.00.025.00.0 28.3 20.0 6/16
68 huggingface/tokenizers 33.316.750.040.00.0 28.0 7.7 5/19
69 Azure/Azure-Sentinel 0.040.00.0100.00.0 28.0 0.0 4/12
70 browser-use/browser-use 100.033.30.00.00.0 26.7 20.0 5/16
71 bytedance/sonic 33.30.00.0100.00.0 26.7 16.7 3/11
72 grafana/grafana 33.340.00.060.00.0 26.7 11.1 6/15
72 lobehub/lobe-chat 33.340.00.060.00.0 26.7 11.1 6/15
74 Aider-AI/aider 66.716.70.050.00.0 26.7 10.0 5/16
75 google-gemini/gemini-cli 33.360.00.040.00.0 26.7 0.0 6/15
75 RooCodeInc/Roo-Code 33.360.00.040.00.0 26.7 0.0 6/15
75 tj/commander.js 33.360.00.040.00.0 26.7 0.0 6/15
78 duckdb/duckdb 0.033.30.0100.00.0 26.7 0.0 3/9
79 netty/netty 0.033.30.0100.00.0 26.7 0.0 2/8
79 octokit/octokit.net 0.033.30.0100.00.0 26.7 0.0 2/8
79 redis/redis 0.033.30.0100.00.0 26.7 0.0 2/8
82 bmad-code-org/bmad-method 66.720.00.040.00.0 25.3 10.0 5/15
83 eosphoros-ai/DB-GPT 33.333.30.060.00.0 25.3 9.1 6/17
84 llvm/llvm-project 0.075.00.050.00.0 25.0 16.7 4/10
85 ggml-org/llama.cpp 50.025.00.050.00.0 25.0 16.7 3/10
86 looplj/axonhub 33.325.00.066.70.0 25.0 14.3 4/12
87 ollama/ollama 0.025.00.0100.00.0 25.0 0.0 3/11
87 Tencent/ncnn 0.025.00.0100.00.0 25.0 0.0 3/11
89 mui/material-ui 33.350.00.040.00.0 24.7 10.0 6/16
90 boto/boto3 66.750.00.00.00.0 23.3 20.0 5/16
90 fastapi/fastapi 66.750.00.00.00.0 23.3 20.0 5/16
90 stanfordnlp/dspy 33.333.30.050.00.0 23.3 20.0 5/16
93 opengrep/opengrep 66.750.00.00.00.0 23.3 16.7 4/10
94 bridgecrewio/checkov 33.333.30.050.00.0 23.3 10.0 5/16
94 infiniflow/ragflow 33.333.30.050.00.0 23.3 10.0 5/16
94 salesforce/cloudsplaining 33.333.30.050.00.0 23.3 10.0 5/16
97 openai/openai-python 0.016.750.050.00.0 23.3 10.0 4/16
98 anthropics/claude-agent-sdk-python 33.333.30.050.00.0 23.3 0.0 5/16
98 emcie-co/parlant 33.333.30.050.00.0 23.3 0.0 5/16
100 remix-run/react-router 33.340.00.040.00.0 22.7 11.1 5/15
100 snyk/cli 33.360.00.020.00.0 22.7 11.1 5/15
102 continuedev/continue 33.340.00.040.00.0 22.7 0.0 5/15
102 firecrawl/pdf-inspector 33.340.00.040.00.0 22.7 0.0 5/17
102 juspay/hyperswitch 33.340.00.040.00.0 22.7 0.0 5/17
102 tree-sitter/tree-sitter 33.340.00.040.00.0 22.7 0.0 5/17
106 mvanhorn/last30days-skill 0.033.350.025.00.0 21.7 20.0 4/16
107 fatedier/frp 33.325.00.050.00.0 21.7 0.0 3/11
108 freeCodeCamp/freeCodeCamp 33.333.30.040.00.0 21.3 10.0 5/16
109 argoproj/argo-cd 0.083.30.020.00.0 20.7 20.0 6/16
110 logseq/logseq 33.320.00.050.00.0 20.7 0.0 3/12
111 SWE-agent/SWE-agent 66.733.30.00.00.0 20.0 20.0 4/16
111 vllm-project/vllm 66.733.30.00.00.0 20.0 20.0 4/16
113 vlang/v 0.00.00.00.0100.0 20.0 14.3 1/10
114 better-auth/better-auth 0.060.00.040.00.0 20.0 11.1 5/15
114 likec4/likec4 0.040.00.060.00.0 20.0 11.1 5/15
116 mastodon/mastodon 0.060.00.040.00.0 20.0 0.0 5/15
117 p-e-w/heretic 33.316.70.050.00.0 20.0 0.0 4/16
118 gin-gonic/gin 0.050.00.050.00.0 20.0 0.0 3/11
119 30-seconds/30-seconds-of-code 0.00.00.0100.00.0 20.0 0.0 2/11
120 Helicone/helicone 33.340.00.020.00.0 18.7 11.1 4/15
121 facebook/react-native 33.340.00.020.00.0 18.7 0.0 4/15
121 firecrawl/firecrawl 33.320.00.040.00.0 18.7 0.0 4/15
121 gravitational/teleport 33.340.00.020.00.0 18.7 0.0 4/15
121 nestjs/nest 33.340.00.020.00.0 18.7 0.0 4/15
121 ogulcancelik/herdr 33.320.00.040.00.0 18.7 0.0 4/17
121 oven-sh/bun 33.340.00.020.00.0 18.7 0.0 4/15
121 serverless/serverless 33.320.00.040.00.0 18.7 0.0 4/15
121 SigNoz/signoz 33.320.00.040.00.0 18.7 0.0 4/15
121 sveltejs/svelte 33.320.00.040.00.0 18.7 0.0 4/15
121 vercel/next.js 33.340.00.020.00.0 18.7 0.0 4/15
121 vuejs/core 33.340.00.020.00.0 18.7 0.0 4/15
132 django/django 33.333.30.025.00.0 18.3 10.0 4/16
133 awslabs/agentcore-samples 33.333.30.025.00.0 18.3 0.0 4/16
134 vitejs/vite 0.050.00.040.00.0 18.0 10.0 5/16
135 expressjs/express 0.050.00.040.00.0 18.0 0.0 4/14
136 ant-design/ant-design 33.333.30.020.00.0 17.3 0.0 4/16
137 microsoft/markitdown 33.30.00.050.00.0 16.7 0.0 3/16
138 cloudflare/agents 0.040.00.040.00.0 16.0 0.0 4/15
138 drizzle-team/drizzle-orm 0.040.00.040.00.0 16.0 0.0 4/15
138 menloresearch/jan 0.040.00.040.00.0 16.0 0.0 4/15
138 nodejs/node 0.040.00.040.00.0 16.0 0.0 4/15
138 wavetermdev/waveterm 0.040.00.040.00.0 16.0 0.0 4/15
143 oraios/serena 33.316.70.025.00.0 15.0 10.0 3/16
144 hashicorp/terraform 0.025.00.050.00.0 15.0 0.0 2/11
144 temporalio/temporal 0.025.00.050.00.0 15.0 0.0 2/11
146 microsoft/playwright 0.033.30.040.00.0 14.7 10.0 4/16
147 bytedance/UI-TARS-desktop 33.320.00.020.00.0 14.7 0.0 3/15
147 facebook/yoga 33.340.00.00.00.0 14.7 0.0 3/11
149 aws/aws-sdk-js 0.050.00.020.00.0 14.0 0.0 3/14
149 vadimdemedes/ink 33.316.70.020.00.0 14.0 0.0 3/16
151 apache/apisix 0.020.00.050.00.0 14.0 0.0 2/12
151 iptv-org/iptv 0.020.00.050.00.0 14.0 0.0 2/12
151 volcano-sh/volcano 0.020.00.050.00.0 14.0 0.0 2/12
154 Homebrew/brew 0.066.70.00.00.0 13.3 16.7 2/8
155 awslabs/aidlc-workflows 0.066.70.00.00.0 13.3 10.0 4/16
156 comfyanonymous/ComfyUI 0.016.70.050.00.0 13.3 0.0 3/16
156 TauricResearch/TradingAgents 0.016.70.050.00.0 13.3 0.0 3/16
158 n8n-io/n8n 0.020.00.040.00.0 12.0 22.2 3/15
159 dyad-sh/dyad 0.020.00.040.00.0 12.0 11.1 3/15
160 alacritty/alacritty 0.020.00.040.00.0 12.0 0.0 3/17
160 cypress-io/cypress 0.040.00.020.00.0 12.0 0.0 3/15
160 evanw/esbuild 0.020.00.040.00.0 12.0 0.0 3/15
160 langchain-ai/langchainjs 0.040.00.020.00.0 12.0 0.0 3/15
160 nrwl/nx 0.040.00.020.00.0 12.0 0.0 3/15
160 prisma/prisma 0.020.00.040.00.0 12.0 0.0 3/15
160 supermemoryai/supermemory 0.020.00.040.00.0 12.0 0.0 3/15
160 vercel/ai 0.020.00.040.00.0 12.0 0.0 3/15
168 langchain-ai/langchain 33.30.00.025.00.0 11.7 10.0 2/16
169 ChatGPTBox-dev/chatGPTBox 33.325.00.00.00.0 11.7 0.0 2/10
170 unionlabs/union 0.040.00.016.70.0 11.3 0.0 3/18
171 cloudflare/workers-sdk 0.033.30.020.00.0 10.7 0.0 3/16
172 supabase/supabase 33.30.00.020.00.0 10.7 0.0 2/15
172 vercel/turborepo 33.30.00.020.00.0 10.7 0.0 2/17
174 neovim/neovim 0.050.00.00.00.0 10.0 14.3 2/10
175 apache/spark 0.00.00.050.00.0 10.0 14.3 1/9
176 pytorch/pytorch 0.00.00.050.00.0 10.0 10.0 2/16
176 TanStack/router 33.316.70.00.00.0 10.0 10.0 2/16
178 avelino/awesome-go 0.00.00.050.00.0 10.0 0.0 1/12
178 Azure/azure-sdk-for-net 0.00.00.050.00.0 10.0 0.0 1/11
178 dotnet/runtime 0.00.00.050.00.0 10.0 0.0 1/9
178 elastic/elasticsearch 0.00.00.050.00.0 10.0 0.0 1/10
182 cline/cline 0.020.00.020.00.0 8.0 11.1 2/15
183 servo/servo 0.00.00.040.00.0 8.0 9.1 2/17
184 calcom/cal.com 0.020.00.020.00.0 8.0 0.0 2/15
184 chalk/chalk 0.020.00.020.00.0 8.0 0.0 2/15
184 coleam00/Archon 0.040.00.00.00.0 8.0 0.0 2/15
184 discourse/discourse 0.040.00.00.00.0 8.0 0.0 2/15
184 elie222/inbox-zero 0.00.00.040.00.0 8.0 0.0 2/15
184 facebook/react 0.020.00.020.00.0 8.0 0.0 2/15
184 fastify/fastify 0.020.00.020.00.0 8.0 0.0 2/15
184 kilo-org/kilocode 0.020.00.020.00.0 8.0 0.0 2/15
184 microsoft/typescript 0.020.00.020.00.0 8.0 0.0 2/15
184 mountain-loop/yaak 0.00.00.040.00.0 8.0 0.0 2/15
184 rocicorp/mono 0.020.00.020.00.0 8.0 0.0 2/15
184 smallcloudai/refact 0.00.00.040.00.0 8.0 0.0 2/19
196 electron/electron 0.016.70.020.00.0 7.3 0.0 2/16
197 tanstack/query 0.033.30.00.00.0 6.7 10.0 2/16
198 docker/compose 33.30.00.00.00.0 6.7 0.0 1/15
198 kamranahmedse/developer-roadmap 33.30.00.00.00.0 6.7 0.0 1/9
200 anthropics/anthropic-sdk-python 0.00.00.025.00.0 5.0 11.1 1/15
201 apache/mxnet 0.00.00.025.00.0 5.0 0.0 1/16
201 Azure/azure-powershell 0.025.00.00.00.0 5.0 0.0 1/10
201 calesthio/OpenMontage 0.00.00.025.00.0 5.0 0.0 1/16
204 influxdata/influxdb 0.00.00.020.00.0 4.0 10.0 1/16
205 cloudflare/workerd 0.020.00.00.00.0 4.0 0.0 1/15
205 decolua/9router 0.00.00.020.00.0 4.0 0.0 1/14
205 honojs/hono 0.020.00.00.00.0 4.0 0.0 1/15
205 rails/rails 0.020.00.00.00.0 4.0 0.0 1/11
205 rust-lang/rust 0.00.00.020.00.0 4.0 0.0 1/17
205 twentyhq/twenty 0.00.00.020.00.0 4.0 0.0 1/15
211 denoland/deno 0.00.00.016.70.0 3.3 8.3 1/18
212 angular/angular 0.016.70.00.00.0 3.3 0.0 1/16
212 anthropics/claude-code 0.016.70.00.00.0 3.3 0.0 1/12
214 agent0ai/agent-zero 0.00.00.00.00.0 0.0 0.0 0/15
214 apache/kafka 0.00.00.00.00.0 0.0 0.0 0/8
214 apple/container 0.00.00.00.00.0 0.0 0.0 0/8
214 Azure/azure-cli 0.00.00.00.00.0 0.0 0.0 0/16
214 Azure/azure-quickstart-templates 0.00.00.00.00.0 0.0 0.0 0/10
214 bazelbuild/bazel 0.00.00.00.00.0 0.0 0.0 0/8
214 ChatGPTNextWeb/NextChat 0.00.00.00.00.0 0.0 0.0 0/15
214 chef/chef 0.00.00.00.00.0 0.0 0.0 0/8
214 ClickHouse/ClickHouse 0.00.00.00.00.0 0.0 0.0 0/8
214 colinhacks/zod 0.00.00.00.00.0 0.0 0.0 0/16
214 commaai/openpilot 0.00.00.00.00.0 0.0 0.0 0/16
214 deeplearning4j/deeplearning4j 0.00.00.00.00.0 0.0 0.0 0/8
214 EbookFoundation/free-programming-books 0.00.00.00.00.0 0.0 0.0 0/10
214 flutter/flutter 0.00.00.00.00.0 0.0 0.0 0/8
214 getsentry/sentry-php 0.00.00.00.00.0 0.0 0.0 0/10
214 ghostty-org/ghostty 0.00.00.00.00.0 0.0 0.0 0/8
214 golang/go 0.00.00.00.00.0 0.0 0.0 0/10
214 google-gemini/gemini-skills 0.00.00.00.00.0 0.0 0.0 0/9
214 hyprwm/Hyprland 0.00.00.00.00.0 0.0 0.0 0/8
214 istio/istio 0.00.00.00.00.0 0.0 0.0 0/11
214 JetBrains/kotlin 0.00.00.00.00.0 0.0 0.0 0/7
214 karpathy/nanochat 0.00.00.00.00.0 0.0 0.0 0/15
214 Kong/kong 0.00.00.00.00.0 0.0 0.0 0/9
214 kubeflow/kubeflow 0.00.00.00.00.0 0.0 0.0 0/10
214 kubernetes/kubernetes 0.00.00.00.00.0 0.0 0.0 0/10
214 laravel/framework 0.00.00.00.00.0 0.0 0.0 0/8
214 microsoft/terminal 0.00.00.00.00.0 0.0 0.0 0/7
214 openai/skills 0.00.00.00.00.0 0.0 0.0 0/15
214 opencut-app/opencut 0.00.00.00.00.0 0.0 0.0 0/14
214 opencv/opencv 0.00.00.00.00.0 0.0 0.0 0/7
214 ossu/computer-science 0.00.00.00.00.0 0.0 0.0 0/9
214 paper-design/shaders 0.00.00.00.00.0 0.0 0.0 0/15
214 quarkusio/quarkus 0.00.00.00.00.0 0.0 0.0 0/8
214 QwenLM/Qwen3 0.00.00.00.00.0 0.0 0.0 0/9
214 shadcn-ui/ui 0.00.00.00.00.0 0.0 0.0 0/15
214 spring-projects/spring-boot 0.00.00.00.00.0 0.0 0.0 0/8
214 spring-projects/spring-framework 0.00.00.00.00.0 0.0 0.0 0/8
214 tensorflow/swift 0.00.00.00.00.0 0.0 0.0 0/9
214 tensorflow/tensorflow 0.00.00.00.00.0 0.0 0.0 0/16
214 torvalds/linux 0.00.00.00.00.0 0.0 0.0 0/7
214 vercel-labs/agent-skills 0.00.00.00.00.0 0.0 0.0 0/9
214 wagoodman/dive 0.00.00.00.00.0 0.0 0.0 0/11
214 zen-browser/desktop 0.00.00.00.00.0 0.0 0.0 0/14

Scoring

VerifyBench (Yan et al., ICLR 2026, arXiv:2505.15801) benchmarks reward verifiers for language models. It scores a verifier by accuracy: the share of labelled items it judges correctly. It reports that accuracy per answer type (numbers, expressions, multiple choice, strings), takes the unweighted average across the types, and adds a Hard split of items that strong models disagree on. The paper does not rank software repositories. This leaderboard borrows its structure:

  • Item: a pair of repository and check kind, where the kind applies to the repository. A kind applies when a recognised tool for it exists for one of the repository's languages or for any language, when the repository runs it anyway, or (for CI workflow linting) when the repository has GitHub Actions workflows.
  • Correct: the repository runs a tool of that kind that the scanner recognises. Tools that are only declared as dependencies, and never run, do not count.
  • Per-method accuracy: the share of correct items within one method, in place of VerifyBench's per-answer-type accuracy. A dash means no kind of that method applies.
  • AVG: the unweighted mean of the per-method accuracies, so a method with many check kinds counts no more than one with few.
  • Hard: accuracy over the check kinds that fewer than 25% of the repositories they apply to run, in place of VerifyBench-Hard's disagreement items.
  • Ties: ordered by AVG, then Hard, then the number of kinds run. Repositories equal on all three share a rank.

Hard kinds: File hygiene (13%), Spelling (7%), Secret scanning (2%), CI workflow linting (16%), Docs build (11%), End-to-end browser tests (17%), Property-based tests (12%), Fuzzing (7%), Mutation testing (1%), Dependency audit (14%), Lockfile consistency (20%), Undefined-behaviour detection (11%), Concurrency model checking (4%), Proofs and specifications (1%).

What it does not measure

  • Only what the scanner reads from CI workflows, hooks, task runners and manifests is counted. A repository that verifies with tools the scanner does not recognise, or in infrastructure outside the repository, scores lower than it should.
  • Code review, finding validation, intent, threat modeling and feedback techniques are not detectable from configuration and are not scored.
  • Running a check is not the same as running it well: the score says nothing about test quality, rule sets or how failures are handled.