Know which dependencies you can build on
Every package gets a single trust grade, A to F, built from how well the project behind it is maintained, reviewed, and secured. Know at a glance whether a dependency is safe to build on - or whether it's time to fork it, replace it, or contribute a fix.
Every dependency, graded A to F
Each package gets a single trust grade you can read at a glance - no page of individual checks to interpret. An A is a healthy, well-run project you can build on with confidence; an F means look closer before you commit. Every grade is measured against the typical package in its ecosystem, so it's a fair comparison rather than an absolute bar.
- A single A-to-F grade for every package
- Measured against the typical package in its ecosystem
- Readable at a glance, no security expertise needed
Rely on it, fork it, or find an alternative?
A trust grade turns a gut call into an informed one. Leaning on a package that quietly stopped being maintained is a risk you take on blindly today. A low grade tells you when a dependency is worth forking, contributing a fix to, or replacing before you're locked in - and a high grade tells you when one is safe to standardize on across your projects.
- Decide with confidence whether to depend on a package
- Catch dependencies that stopped being maintained
- Vet a package before you standardize on it
Built from how the project is actually run
The grade comes from OpenSSF Scorecard and deps.dev - public, independent data about the project behind each package. Is code reviewed before it's merged? Is the main branch protected? Are releases signed? Is anyone still maintaining it? Signals about the maintainers, the community, and the project's CI practices roll up into one grade, so you're trusting evidence about how the project is run, not a vendor's opinion.
- OpenSSF Scorecard: maintenance, code review, branch protection, and more
- deps.dev: stars, forks, open issues, license
- Public data sources, not a black-box model
Look up any package, before you add it
Trust grades aren't limited to what's already in your projects. Search any package by name and see its grade before you install it, so you're evaluating a dependency while you're still choosing it - not after you've shipped it. Everything in your SBOM is graded automatically, direct and transitive; anything you're considering is one search away.
- Every package in your SBOM, graded on every scan
- Search any package by name before you add it
- npm, Go, Maven, PyPI, NuGet, Cargo, and RubyGems
FAQ about open source trust scores
What is a package trust score?
A trust score is a single grade, A to F, for how healthy and well-run the open source project behind a package is - how actively it's maintained, whether changes get reviewed, whether its releases and CI follow good security practice. It answers a question a vulnerability scan can't: not "does this package have a known bug," but "is this something I should rely on at all." Every package in your inventory gets one, and you can look up any other package on demand.
How is the grade calculated?
It's built from two public, independent sources: OpenSSF Scorecard, which evaluates a project's repository across maintenance, code review, branch protection, dangerous CI workflows, signed releases, and more; and deps.dev, which adds project metadata like stars, forks, open issues, and license. Those signals are combined into one grade, measured against the typical package in the same ecosystem so the comparison is fair.
How is this different from vulnerability scanning?
Vulnerability scanning tells you which dependencies have a known, published CVE. A trust score tells you whether a package is well-run enough to depend on in the first place - a package can have zero known vulnerabilities and still be abandoned, unreviewed, and risky to build on. The two answer different questions, and you want both.
Can I check a package before I add it to my project?
Yes. You're not limited to packages already in your inventory - look up any package by name and see its trust grade before you install it. That's the point at which the grade is most useful: when you're deciding between two libraries, or weighing whether to take on a new dependency at all.
Which packages and ecosystems are covered?
Every package in your SBOM, direct and transitive, across npm, Go, Maven, PyPI, NuGet, Cargo, and RubyGems. Grades are computed as part of generating your software inventory - nothing to select or configure.
A package I depend on scored badly. What should I do?
A low grade is a prompt to look, not an automatic verdict. Depending on where the package sits in your stack, that might mean pinning to a known-good version, contributing a fix upstream, forking it if it's abandoned but critical, or planning a move to a better-maintained alternative. The grade's job is to surface the ones worth that attention before they cause a problem.
Is it safe to give Lumstep access to my code and dependency manifests?
Yes. Scans run in isolated, per-tenant sandboxes, your data is encrypted with keys unique to your organization, and nothing is shared across customers.
See how much of your stack you can actually trust.
Free early access. Trust grades are ready on your first SBOM, no extra configuration.