A health grade on a Gold package page summarizes how well a project follows security practices. Where a Scorecard exists, the aggregate is a weighted average of checks scored 0 to 10, so a package can have a high overall grade and still score zero on one check. Read the weak checks, not just the letter.
Where the grade comes from
The page says the grade is derived from OpenSSF Scorecard where one is published. If none exists, it falls back to a Safeguard maintenance heuristic using release activity and metadata, and says that no Scorecard is published. Look for that note, because the two sources are not the same thing.
How Scorecard scores
Per the project's documentation, each check scores 0 to 10, and the aggregate is a weighted average by risk: critical checks weigh 10, high 7.5, medium 5 and low 2.5. Checks seen on package pages include Maintained, Vulnerabilities, Dangerous Workflow, Code Review, Security Policy, Dependency Update Tool, Fuzzing and Pinned Dependencies.
An example of mixed results
One popular package page we reviewed showed an overall A at 8.9 out of 10, with most checks at 10, Pinned Dependencies at 6 and Fuzzing at 0. That is normal. Fuzzing is a medium risk check that many projects never adopt. A zero does not mean the package is dangerous.
Which checks to look at first
- Maintained. Is anyone still working on it? Scorecard's Maintained check asks for recent activity.
- Vulnerabilities. Does the project have open known issues?
- Code Review. Are changes reviewed before merging?
- Dangerous Workflow. Are there risky CI patterns?
- Security Policy. Is there a way to report a flaw?
Fuzzing and Pinned Dependencies are good to have but rarely decisive for a small dependency.
Limits to keep in mind
The Scorecard project itself says its checks are heuristics that can give false positives and negatives. It also says an aggregate does not show which practices a repository does or does not follow, and that scores change as checks are refined. Some checks may not be available for every repository. Two factor authentication is recommended but not a Scorecard check, since that data is not public.
What to do with the grade
Use it to rank candidates, not to approve one. Between two packages that do the same job, take the one with active maintenance and code review. Then read the checklist and vulnerability count on the Gold page.
Pair it with your own signals
Look at the last release date, issue response time and number of maintainers. For deeper analysis in your own pipeline, Safeguard policies can set minimum requirements. See also /resources/blog/read-a-gold-package-page-section-by-section and try the free scan at gold.safeguard.sh/scan.
Quick check
Is a B grade bad?
Not on its own. Look at which checks pull it down and whether they matter for how you use the package.
Sources
Last reviewed: 19 October 2026.
