I wrote down 61 rules about the boring half of open source, then pointed them at a gem of my own I would have told you was in decent shape. 16 pass, 27 fail, 0 unknown, 18 not applicable.

Kubernetes has an OpenSSF Best Practices badge. It earned that badge on 16 August 2017, and the entry has not been edited since. The save that earned it is still the last save anyone made: the two timestamps sit 3 milliseconds apart. The badge image carries no date.

On June 3rd Bundler shipped a feature called cooldown: refuse to resolve any release younger than N days. The announcement described the threat as an account getting compromised and a malicious version shipping. 45 days later, SleeperGem did exactly that to three gems.

Two years ago I published a Ruby gem for conditional CSS classes. First comment: "What is the main difference with rails class_names helper?" I didn't know class_names existed. I'd built a gem for something Rails already shipped. I went and looked. It runs out in four places.

records.select { |r| seen.include?(r.id) } If seen is an Array, this line is O(n²). I measured it in Ruby: double the input, 4x the time, fitted exponent 1.99. Fine on the 100 rows you tested, dead on the 100k you didn't.