Usually not. A listing, badge or score tells you something narrow, and each publisher documents what. Landscapes categorize, badges are often self-certified, grids are relative, and scores can be heuristics. None of them replaces testing a tool, or reading a project, against your own needs.
Myth: being on the CNCF landscape means a project was vetted
The landscape README calls it a map meant to categorize most projects and product offerings in the cloud native space. Inclusion criteria are practical: a project with at least 300 GitHub stars that clearly fits a category is generally included, and closed source products need a link to a clear product description. Nothing there describes a security review.
Myth: a graduated CNCF project is a secure project
CNCF describes graduated projects as stable, widely adopted and production ready. Projects advance by showing sustainability to the Technical Oversight Committee, which covers adoption, a healthy rate of change and committers from multiple organizations. They must also keep the Best Practices Badge. Those are maturity and health signals. They are useful, but they are not an audit result.
Myth: the OpenSSF Best Practices Badge is an audit
The badge page says projects voluntarily self-certify, at no cost, by explaining how they follow each practice. Automated analysis fills in many answers and blocks obviously wrong ones. The page mentions no independent third party verification.
Myth: a high OpenSSF Scorecard number means safe
The Scorecard documentation says the checks are heuristics that can produce false positives and false negatives. It describes itself as opinionated and not a definitive standard, and warns that one aggregate score hides which practices a repository follows. Look at individual checks.
Myth: a high G2 score means it works best for you
G2 normalizes scores within a category and states that reviews are subjective experiences. A score is a relative position among reviewed products, not a measure of detection quality.
Myth: the OWASP Top 10 is a standard to certify against
OWASP calls it a standard awareness document for developers and web application security that represents a broad consensus about the most critical risks. It is a communication tool. A product saying it covers the Top 10 should be asked which categories, how, and with what evidence.
A better habit
For each badge or ranking you meet, write one line: what does this publisher say it measures, and who did the measuring? If the answer is "the project itself" or "other users", weight it accordingly. Then test the tool. Our post on what a low Scorecard score does and does not mean goes deeper on one of these.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis and policies and gates. You can check its output yourself with the free scan at gold.safeguard.sh/scan.
Quick check
Which signal is closest to an independent check?
None of the ones above is an independent audit. The badge is self-certified, grids come from user reviews, and the landscape categorizes.
Sources
- CNCF landscape README
- CNCF project metrics
- OpenSSF Best Practices Badge
- OpenSSF Scorecard README
- G2 research scoring methodologies
- OWASP Top 10 project
Last reviewed: 19 October 2026.
