# ADR 053: OpenSSF Scorecard (Repo Security Posture)

- HTML version: https://robbiepalmer.me/projects/recipe-site/adrs/057-openssf-scorecard
- Project: Recipe Site (https://robbiepalmer.me/projects/recipe-site.md)
- Status: Accepted
- Date: 2026-07-20
- Inherited from project: personal-site (https://robbiepalmer.me/projects/personal-site/adrs/053-openssf-scorecard.md)

# Additional Context for Recipe Site

Scorecard audits the repository layer, so the recipe site inherits the same
weekly posture check (see
[personal-site ADR 053](/projects/personal-site/adrs/053-openssf-scorecard)).
The stakes are higher on this side of the monorepo: the branch-protection,
token-permission, and dangerous-workflow checks guard the path by which code
reaches the deployed Workers and the Neon database, and the preview-environment
workflows handle real credentials on pull requests
([ADR 046 zizmor](/projects/recipe-site/adrs/046-zizmor) covers their content;
Scorecard covers the settings around them).

# Consequences

## Positive

* Regressions in the repo settings that gate deploy credentials (branch
  protection, default token permissions) now surface within a week instead of
  silently persisting.

## Negative

* Scorecard evaluates the repository as a whole; it cannot score the
  recipe-site backend's posture separately from the static site's.

## Notes for Recipe Site

# Additional Context for Recipe Site

Scorecard audits the repository layer, so the recipe site inherits the same
weekly posture check (see
[personal-site ADR 053](/projects/personal-site/adrs/053-openssf-scorecard)).
The stakes are higher on this side of the monorepo: the branch-protection,
token-permission, and dangerous-workflow checks guard the path by which code
reaches the deployed Workers and the Neon database, and the preview-environment
workflows handle real credentials on pull requests
([ADR 046 zizmor](/projects/recipe-site/adrs/046-zizmor) covers their content;
Scorecard covers the settings around them).

# Consequences

## Positive

* Regressions in the repo settings that gate deploy credentials (branch
  protection, default token permissions) now surface within a week instead of
  silently persisting.

## Negative

* Scorecard evaluates the repository as a whole; it cannot score the
  recipe-site backend's posture separately from the static site's.

---

Markdown index of this site: https://robbiepalmer.me/llms.txt