// OpenSSF Scoring Algorithm

Methodology & Criticality Scoring

We reimplement OpenSSF's published criticality scoring algorithm in high-performance JavaScript for serverless execution using standard GitHub API endpoints.

criticality_score.ts
[ LOG-NORMALIZED WEIGHTED SUM ]
// Formula definition
const criticalityScore = (
  commits * 0.25 + contributors * 0.20 + recency * 0.20 +
  age * 0.15 + issues * 0.10 + usage * 0.10
);

Each raw metric is log-scaled prior to weighting to prevent extreme outliers (e.g. mega-repos) from skewing normalized distributions. Output score ranges strictly from 0.00 to 1.00.

// Parameter Breakdown Matrix

Commit Frequency

25%

Commits in the last 90 days. Active maintenance is the strongest signal that a project is alive and being improved.

Projects with regular commits are actively maintained, meaning funding has immediate impact.

EXAMPLE: linux kernel: ~3000 commits/90d → high score

Contributor Count

20%

Number of distinct contributors. More contributors = healthier project with shared ownership.

A project with 100+ contributors is embedded in many workflows, making it critical infrastructure.

EXAMPLE: 1 contributor = fragile, 50+ = resilient

Recent Activity

20%

Time since the last push. Recent activity indicates the project is actively maintained.

A project last updated 2 years ago might be abandoned, even if it has high lifetime stars.

EXAMPLE: Updated yesterday → 1.0, 6 months ago → ~0.5

Project Age

15%

Time since project creation. Older, still-active projects are deeply embedded in the ecosystem.

A 10-year-old project that's still actively maintained is depended on by thousands of projects.

EXAMPLE: 10+ years old + active = high stability

Issue Activity

10%

Open issues as a proxy for community engagement and active user feedback.

Issues indicate active users finding edge cases and engaging with maintainers.

EXAMPLE: 0 issues = unused, 500+ = widely used

Stars + Forks

10%

Usage signal and visibility proxy. Stars indicate awareness; forks indicate active use.

Combined with activity signals, stars & forks confirm ecosystem adoption.

EXAMPLE: 10k stars + 2k forks = high adoption

Methodology Boundaries & Constraints

  • [!]Stars are down-weighted (10%): Stars alone can be inflated by social trends. We require active commit cadence and contributor volume for high scores.
  • [!]Public metadata only: Scoring relies strictly on public GitHub API endpoints — private downstream dependencies are approximated via stars and forks.