Plugin scoring
Score a plugin
Review the CANARY score, rationale, and supporting evidence.
AI explanation
Explain this score
Bring your own AI
Copy the prompt below and paste it into Claude, ChatGPT, or any other AI assistant. You control what gets shared.
Show / edit raw prompt
"Explain now" uses the server API key (max 3/hr). "Open in" buttons use your own account with no limits. AI-generated explanations are provided for informational purposes only, may contain inaccuracies or omissions, and should not be relied upon as authoritative security guidance.
CANARY score
Advisory risk score
Select an algorithm, feature set, and evaluation strategy on the left.
Honest track record
Where git-client ranked before each window
Activity-recency clocks + Contributor dynamics · Logistic Regression, embargoed rolling backtest: the rank this plugin held among every scored plugin at each forecast date, using only what was knowable then. Shaded months are the pre-registered holdout.
Scored at 32 forecast dates; on average in the top 5.3% of plugins (top 1.3% across the holdout). An advisory followed within 180 days of 10 of those dates.
| Holdout month | Score | Rank | Share of panel | What followed |
|---|---|---|---|---|
| 2025-07 | 79.2% | 11 of 2,053 | top 0.49% | SECURITY-3590 2025-09-03 |
| 2025-08 | 77.7% | 13 of 2,053 | top 0.58% | SECURITY-3590 2025-09-03 |
| 2025-09 | 75.5% | 15 of 2,053 | top 0.68% | SECURITY-3590 2025-09-03 |
| 2025-10 | 72.0% | 28 of 2,053 | top 1.3% | SECURITY-3614 2025-12-10 |
| 2025-11 | 69.7% | 32 of 2,053 | top 1.5% | SECURITY-3614 2025-12-10 |
| 2025-12 | 67.4% | 64 of 2,053 | top 3.1% | SECURITY-3614 2025-12-10 |
Risk context
Supporting signals
Maintenance history, governance, and dependency risk indicators for this plugin.
Key risk signals
- 6 prior advisory record(s) — history +12, recency +10 (0 within 90d, 2 within 365 days); component total +22 (cap 30).
- Advisory severity (max CVSS 8.8 — High): +15 (cap 15).
- Latest release: 2026-06-10.
- Requires Jenkins core 2.516.3.
- Last commit: September 21, 2026 — live data from GitHub.
- Recent release activity supports active maintenance.
- 6 historical security warning(s) — none currently active.
- No SECURITY.md — vulnerability reporting process undocumented (+3).
- No Dependabot or GitHub Actions detected — limited automated maintenance (+3).
- No changelog detected — release transparency limited (+2).
- Dependency risk: 5 of 10 dep(s) have advisories; worst: script-security (CVSS 8.8).
- Plugin health score 100/100 — acceptable maintenance posture.
Feature details (34 keys)
{
"advisory_count": 6,
"latest_advisory_date": "2026-06-24",
"days_since_latest_advisory": 92,
"advisory_within_90d": 0,
"advisory_within_365d": 2,
"had_advisory_within_365d": true,
"max_cvss_base_score_observed": 8.8,
"max_cvss_severity_label_observed": "High",
"swh_present": true,
"swh_days_since_last_commit": 1.0,
"swh_commit_count": 51351,
"swh_has_security_md": false,
"swh_has_dependabot": false,
"swh_has_github_actions": false,
"swh_has_tests_directory": true,
"swh_has_changelog": false,
"swh_security_fix_commit_count": 1284,
"has_plugin_snapshot": true,
"required_core": "2.516.3",
"dependency_count": 10,
"security_warning_count": 6,
"active_security_warning_count": 0,
"release_timestamp": "2026-06-10T01:09:22+00:00",
"days_since_release": 106,
"dependency_plugins": [
"apache-httpcomponents-client-4-api",
"commons-lang3-api",
"configuration-as-code",
"credentials",
"gson-api",
"mina-sshd-api-common",
"mina-sshd-api-core",
"script-security",
"ssh-credentials",
"structs"
],
"dependency_total": 10,
"dependency_risk_points": 41,
"dependency_risk_summary": {
"deps_with_any_advisory": 5,
"deps_with_recent_advisory_365d": 1,
"deps_with_active_warning": 0,
"worst_dep_max_cvss": 8.8,
"worst_dep_id": "script-security",
"worst_dep_latest_advisory_date": "2026-06-24"
},
"dependency_missing_data": {
"snapshot_missing": 0,
"advisories_missing": 0,
"healthscore_missing": 0
},
"dependency_details_top": [
{
"plugin_id": "script-security",
"advisory_count": 26,
"latest_advisory_date": "2026-06-24",
"recent_advisory_365d": true,
"max_cvss": 8.8,
"security_warning_count": 28,
"active_security_warning_count": 0,
"healthscore": 100,
"risk_points": 17,
"reasons": [
"26 advisories (+10).",
"Max CVSS 8.8 (+4).",
"Recent advisory within 365d (+3)."
]
},
{
"plugin_id": "credentials",
"advisory_count": 4,
"latest_advisory_date": "2024-10-02",
"recent_advisory_365d": false,
"max_cvss": 4.3,
"security_warning_count": 4,
"active_security_warning_count": 0,
"healthscore": 100,
"risk_points": 10,
"reasons": [
"4 advisories (+8).",
"Max CVSS 4.3 (+2)."
]
},
{
"plugin_id": "configuration-as-code",
"advisory_count": 3,
"latest_advisory_date": "2022-01-12",
"recent_advisory_365d": false,
"max_cvss": 6.5,
"security_warning_count": 9,
"active_security_warning_count": 0,
"healthscore": 100,
"risk_points": 8,
"reasons": [
"3 advisories (+6).",
"Max CVSS 6.5 (+2)."
]
},
{
"plugin_id": "ssh-credentials",
"advisory_count": 1,
"latest_advisory_date": "2018-06-25",
"recent_advisory_365d": false,
"max_cvss": 6.5,
"security_warning_count": 1,
"active_security_warning_count": 0,
"healthscore": 96,
"risk_points": 4,
"reasons": [
"1 advisories (+2).",
"Max CVSS 6.5 (+2)."
]
},
{
"plugin_id": "structs",
"advisory_count": 1,
"latest_advisory_date": "2024-06-26",
"recent_advisory_365d": false,
"max_cvss": null,
"security_warning_count": 1,
"active_security_warning_count": 0,
"healthscore": 100,
"risk_points": 2,
"reasons": [
"1 advisories (+2)."
]
}
],
"healthscore_value": 100,
"healthscore_date": "2026-02-24T02:27:58.344597Z",
"healthscore_collected_at": "2026-02-28T16:43:20+00:00",
"score_components": {
"advisory_history": 22,
"advisory_severity": 15,
"staleness": 0,
"active_warnings": 0,
"governance": 8,
"dependency": 5,
"health_score": 0,
"security_sensitivity": 0
}
}JSON payload
{
"plugin": "git-client",
"score": 50,
"reasons": [
"6 prior advisory record(s) — history +12, recency +10 (0 within 90d, 2 within 365 days); component total +22 (cap 30).",
"Advisory severity (max CVSS 8.8 — High): +15 (cap 15).",
"Latest release: 2026-06-10.",
"Requires Jenkins core 2.516.3.",
"Recent commit activity (1 days ago) suggests active maintenance.",
"Recent release activity supports active maintenance.",
"6 historical security warning(s) — none currently active.",
"No SECURITY.md — vulnerability reporting process undocumented (+3).",
"No Dependabot or GitHub Actions detected — limited automated maintenance (+3).",
"No changelog detected — release transparency limited (+2).",
"Dependency risk: 5 of 10 dep(s) have advisories; worst: script-security (CVSS 8.8).",
"Plugin health score 100/100 — acceptable maintenance posture."
],
"features": {
"advisory_count": 6,
"latest_advisory_date": "2026-06-24",
"days_since_latest_advisory": 92,
"advisory_within_90d": 0,
"advisory_within_365d": 2,
"had_advisory_within_365d": true,
"max_cvss_base_score_observed": 8.8,
"max_cvss_severity_label_observed": "High",
"swh_present": true,
"swh_days_since_last_commit": 1.0,
"swh_commit_count": 51351,
"swh_has_security_md": false,
"swh_has_dependabot": false,
"swh_has_github_actions": false,
"swh_has_tests_directory": true,
"swh_has_changelog": false,
"swh_security_fix_commit_count": 1284,
"has_plugin_snapshot": true,
"required_core": "2.516.3",
"dependency_count": 10,
"security_warning_count": 6,
"active_security_warning_count": 0,
"release_timestamp": "2026-06-10T01:09:22+00:00",
"days_since_release": 106,
"dependency_plugins": [
"apache-httpcomponents-client-4-api",
"commons-lang3-api",
"configuration-as-code",
"credentials",
"gson-api",
"mina-sshd-api-common",
"mina-sshd-api-core",
"script-security",
"ssh-credentials",
"structs"
],
"dependency_total": 10,
"dependency_risk_points": 41,
"dependency_risk_summary": {
"deps_with_any_advisory": 5,
"deps_with_recent_advisory_365d": 1,
"deps_with_active_warning": 0,
"worst_dep_max_cvss": 8.8,
"worst_dep_id": "script-security",
"worst_dep_latest_advisory_date": "2026-06-24"
},
"dependency_missing_data": {
"snapshot_missing": 0,
"advisories_missing": 0,
"healthscore_missing": 0
},
"dependency_details_top": [
{
"plugin_id": "script-security",
"advisory_count": 26,
"latest_advisory_date": "2026-06-24",
"recent_advisory_365d": true,
"max_cvss": 8.8,
"security_warning_count": 28,
"active_security_warning_count": 0,
"healthscore": 100,
"risk_points": 17,
"reasons": [
"26 advisories (+10).",
"Max CVSS 8.8 (+4).",
"Recent advisory within 365d (+3)."
]
},
{
"plugin_id": "credentials",
"advisory_count": 4,
"latest_advisory_date": "2024-10-02",
"recent_advisory_365d": false,
"max_cvss": 4.3,
"security_warning_count": 4,
"active_security_warning_count": 0,
"healthscore": 100,
"risk_points": 10,
"reasons": [
"4 advisories (+8).",
"Max CVSS 4.3 (+2)."
]
},
{
"plugin_id": "configuration-as-code",
"advisory_count": 3,
"latest_advisory_date": "2022-01-12",
"recent_advisory_365d": false,
"max_cvss": 6.5,
"security_warning_count": 9,
"active_security_warning_count": 0,
"healthscore": 100,
"risk_points": 8,
"reasons": [
"3 advisories (+6).",
"Max CVSS 6.5 (+2)."
]
},
{
"plugin_id": "ssh-credentials",
"advisory_count": 1,
"latest_advisory_date": "2018-06-25",
"recent_advisory_365d": false,
"max_cvss": 6.5,
"security_warning_count": 1,
"active_security_warning_count": 0,
"healthscore": 96,
"risk_points": 4,
"reasons": [
"1 advisories (+2).",
"Max CVSS 6.5 (+2)."
]
},
{
"plugin_id": "structs",
"advisory_count": 1,
"latest_advisory_date": "2024-06-26",
"recent_advisory_365d": false,
"max_cvss": null,
"security_warning_count": 1,
"active_security_warning_count": 0,
"healthscore": 100,
"risk_points": 2,
"reasons": [
"1 advisories (+2)."
]
}
],
"healthscore_value": 100,
"healthscore_date": "2026-02-24T02:27:58.344597Z",
"healthscore_collected_at": "2026-02-28T16:43:20+00:00",
"score_components": {
"advisory_history": 22,
"advisory_severity": 15,
"staleness": 0,
"active_warnings": 0,
"governance": 8,
"dependency": 5,
"health_score": 0,
"security_sensitivity": 0
}
}
}