Trust Signal Breakdown high 23 sub-signals across 6 dimensions
Vulnerability & Safety ×0.25 4.3 CVEs, dependency health, and supply chain integrity
3 of 3 sub-signals with data
Known CVEs 40% 5.0
No known CVEs
via OSV.dev
Dependency Health 30% 3.0
68 dependencies (moderate)
via npm / PyPI
Supply Chain 30% 4.8
74 transitive CVEs found (penalty: -0.25)
via npm provenance
Operational Reliability ×0.15 3.6 Uptime, latency, error rates, and incident history
4 of 4 sub-signals with data
Uptime 35% 5.0
100.00% over 6 checks
via Health checks
Response Latency 25% 2.0
p99: 1714ms, p50: 1559ms
via Health checks
Error Rate 20% 5.0
0.00% error rate (0/6)
via Health checks
Incident History 20% 2.0
4 incidents in last 90 days
via Incidents table
Maintenance Activity ×0.15 4.2 Commit recency, release cadence, issue response, CI/CD
4 of 4 sub-signals with data
Commit Recency 30% 5.0
via GitHub
Release Cadence 25% 5.0
via GitHub
Issue Response 20% 1.0
via GitHub
CI/CD Presence 25% 5.0
via GitHub Actions
Adoption ×0.15 2.4 Downloads, stars, dependents, and growth trajectory
3 of 4 sub-signals with data
Download Volume 43% 3.0
8,365 weekly downloads
via npm / PyPI
GitHub Stars 36% 2.0
329 stars
via GitHub
Dependent Packages no data —
Weight redistributed to sub-signals with data
Growth Trend 21% 2.0
-6.1% week-over-week
via npm
Transparency ×0.15 4.7 License, documentation, security policy, changelog
4 of 4 sub-signals with data
Open Source 30% 4.0
Public repo with copyleft license (agpl-3.0)
via GitHub
Documentation 25% 5.0
Docs site present with comprehensive README (>2000 bytes + examples)
via GitHub
Security Policy 20% 5.0
SECURITY.md present
via GitHub
Changelog 25% 5.0
CHANGELOG.md present and releases exist
via GitHub
Publisher Trust ×0.15 4.2 Track record, org maturity, community standing
4 of 4 sub-signals with data
Track Record 30% 3.5
Internal: 3.0 (82 services), External: 3.5 (2184 followers, 7594 stars)
via Fabric index
Org Maturity 30% 5.0
User account, 10.7 years old
via GitHub
Community Standing 20% 5.0
161 public repositories
via GitHub
Cross-Platform 20% 3.0
Present on 2 platform(s): github, npm
via Registry scan
Scored across 23 sub-signals in 6 dimensions Scoring engine v1 (beta) — actively being expanded Phase 1: Core sub-signal architecture (live) Phase 2: Permission scope & expanded collection (in progress)
Trust Assessment AI Assessment
sfdx-hardis is a Salesforce CI/CD orchestration toolkit published on npm under AGPL-3.0 license, available as a GitHub Action. The package shows strong maintenance practices with zero known vulnerabilities and consistent uptime, though it relies on 68 dependencies including several large packages like langchain and exceljs. With only one maintainer and moderate weekly downloads (7.8K), organizations should consider internal review before adopting this tool for production Salesforce pipelines.
Generated by Fabric AI · Mar 4, 2026 at 4:18 AM
Package Availability (30d)
100.00%
p50: 1559ms · p99: 1714ms
Avg Latency
1.5s
averaged across 30d health checks
Weekly Downloads
8.4k-6%
npm weekly
Transparency & Compliance 5/5 passed
Incidents & Alerts last 90 days
Score History 67 snapshots
Feb 21 Mar 5
Community & Ecosystem adoption signals
Supply Chain & Dependencies trust chain
Showing 6 of 69 dependencies Show more →
Data Sources 6 indexed
◎
OSV.dev CVE database · vulnerability scanning for npm & PyPI packages
◈
GitHub API Commits, issues, releases, repo metadata, transparency checks
⬡
npm Registry Package metadata, weekly downloads, maintainers, dependencies
⬡
PyPI Package metadata, weekly downloads, dependency tree
△
HTTP Health Checks 15-min pings · uptime, latency, status monitoring
◎
PyPI Stats Download statistics and trends
Version History score per release
VERSION RELEASED SCORE DELTA
Showing 6 of 10 releases Show more →
Are you the publisher? Claim this profile to unlock deeper evaluation, real-time monitoring,
Claim Provider Report Issue
Share this Trust Score Generate a scorecard image optimised for X, LinkedIn and other social platforms.
⬇ Download Score Card
