Plugin scoring
Score a plugin
Review the CANARY score, rationale, and supporting evidence.
The forecast comes from the frozen champion configuration applied to the newest panel month; the signals beneath it describe the plugin's current state and are not part of the validated forecast.
AI explanation
Explain this score
Bring your own AI
Copy the prompt below and paste it into Claude, ChatGPT, or any other AI assistant. You control what gets shared.
Show / edit raw prompt
"Explain now" uses the server API key (max 3/hr). "Open in" buttons use your own account with no limits. AI-generated explanations are provided for informational purposes only, may contain inaccuracies or omissions, and should not be relied upon as authoritative security guidance.
CANARY forecast · as of 2026-06
oic-auth
Activity-recency clocks + Contributor dynamics · Logistic Regression: the frozen champion fold model (oot_champion/fold_2025-11, trained on months before 2025-11, labels as known 2025-12) applied to the newest month of the panel. Inference only; no outcome for this month is known yet.
Read the rank, not the score. The score is the model's raw output and is not a probability: on the holdout the champion's mean score is about 0.5 against an observed advisory rate of 1 percent. Across the pre-registered holdout, reviewing the top fifth of plugins by this ranking caught about half of the advisories that followed.
Honest track record
Where oic-auth ranked before each window
Activity-recency clocks + Contributor dynamics · Logistic Regression, embargoed rolling backtest: the rank this plugin held among every scored plugin at each forecast date, using only what was knowable then. Shaded months are the pre-registered holdout.
Scored at 32 forecast dates; on average in the top 4.0% of plugins (top 0.80% across the holdout). An advisory followed within six months of 15 of those dates.
| Holdout month | Score | Rank | Share of panel | What followed |
|---|---|---|---|---|
| 2025-07 | 73.7% | 24 of 2,053 | top 1.1% | none within six months |
| 2025-08 | 78.5% | 9 of 2,053 | top 0.39% | none within six months |
| 2025-09 | 76.7% | 14 of 2,053 | top 0.63% | none within six months |
| 2025-10 | 77.0% | 9 of 2,053 | top 0.39% | none within six months |
| 2025-11 | 71.8% | 20 of 2,053 | top 0.93% | none within six months |
| 2025-12 | 70.6% | 28 of 2,053 | top 1.3% | none within six months |
Current-state context
Supporting signals
Maintenance history, governance artifacts, SLSA provenance and known advisories in dependencies, read from the plugin's current public state. A practitioner's dashboard, not part of the validated forecast.
Key risk signals
- 6 prior advisory record(s) — history +12, recency +0 (0 within 90d, 0 within 365 days); component total +12 (cap 30).
- No advisory activity in the last 365 days — historical record only.
- Advisory severity (max CVSS 8.8 — High): +15 (cap 15).
- Latest release: 2026-07-30.
- Requires Jenkins core 2.539.
- Last commit: October 14, 2026 — live data from GitHub.
- Recent release activity supports active maintenance.
- 8 historical security warning(s) — none currently active.
- No SECURITY.md — vulnerability reporting process undocumented (+3).
- No Dependabot or GitHub Actions detected — limited automated maintenance (+3).
- Dependency risk: 1 of 7 dep(s) have advisories; worst: mailer (CVSS 4.8).
- Plugin health score 100/100 — acceptable maintenance posture.
- Plugin name suggests auth/security sensitivity (auth): +20 (cap 20).
Feature details (34 keys)
{
"advisory_count": 6,
"latest_advisory_date": "2025-01-22",
"days_since_latest_advisory": 656,
"advisory_within_90d": 0,
"advisory_within_365d": 0,
"had_advisory_within_365d": false,
"max_cvss_base_score_observed": 8.8,
"max_cvss_severity_label_observed": "High",
"swh_present": true,
"swh_days_since_last_commit": 2.3,
"swh_commit_count": 8432,
"swh_has_security_md": false,
"swh_has_dependabot": false,
"swh_has_github_actions": false,
"swh_has_tests_directory": true,
"swh_has_changelog": true,
"swh_security_fix_commit_count": 56,
"has_plugin_snapshot": true,
"required_core": "2.539",
"dependency_count": 7,
"security_warning_count": 8,
"active_security_warning_count": 0,
"release_timestamp": "2026-07-30T08:06:20+00:00",
"days_since_release": 101,
"dependency_plugins": [
"asm-api",
"commons-lang3-api",
"commons-text-api",
"jackson2-api",
"json-path-api",
"mailer",
"nimbus-jose-jwt-api"
],
"dependency_total": 7,
"dependency_risk_points": 10,
"dependency_risk_summary": {
"deps_with_any_advisory": 1,
"deps_with_recent_advisory_365d": 0,
"deps_with_active_warning": 0,
"worst_dep_max_cvss": 4.8,
"worst_dep_id": "mailer",
"worst_dep_latest_advisory_date": "2022-01-12"
},
"dependency_missing_data": {
"snapshot_missing": 1,
"advisories_missing": 1,
"healthscore_missing": 1
},
"dependency_details_top": [
{
"plugin_id": "mailer",
"advisory_count": 4,
"latest_advisory_date": "2022-01-12",
"recent_advisory_365d": false,
"max_cvss": 4.8,
"security_warning_count": 4,
"active_security_warning_count": 0,
"healthscore": 100,
"risk_points": 10,
"reasons": [
"4 advisories (+8).",
"Max CVSS 4.8 (+2)."
]
}
],
"healthscore_value": 100,
"healthscore_date": "2026-02-24T10:30:27.095608Z",
"healthscore_collected_at": "2026-02-28T16:43:20+00:00",
"score_components": {
"advisory_history": 12,
"advisory_severity": 15,
"staleness": 0,
"active_warnings": 0,
"governance": 6,
"dependency": 2,
"health_score": 0,
"security_sensitivity": 20
}
}JSON payload
{
"plugin": "oic-auth",
"score": 55,
"reasons": [
"6 prior advisory record(s) — history +12, recency +0 (0 within 90d, 0 within 365 days); component total +12 (cap 30).",
"No advisory activity in the last 365 days — historical record only.",
"Advisory severity (max CVSS 8.8 — High): +15 (cap 15).",
"Latest release: 2026-07-30.",
"Requires Jenkins core 2.539.",
"Recent commit activity (2 days ago) suggests active maintenance.",
"Recent release activity supports active maintenance.",
"8 historical security warning(s) — none currently active.",
"No SECURITY.md — vulnerability reporting process undocumented (+3).",
"No Dependabot or GitHub Actions detected — limited automated maintenance (+3).",
"Dependency risk: 1 of 7 dep(s) have advisories; worst: mailer (CVSS 4.8).",
"Plugin health score 100/100 — acceptable maintenance posture.",
"Plugin name suggests auth/security sensitivity (auth): +20 (cap 20)."
],
"features": {
"advisory_count": 6,
"latest_advisory_date": "2025-01-22",
"days_since_latest_advisory": 656,
"advisory_within_90d": 0,
"advisory_within_365d": 0,
"had_advisory_within_365d": false,
"max_cvss_base_score_observed": 8.8,
"max_cvss_severity_label_observed": "High",
"swh_present": true,
"swh_days_since_last_commit": 2.3,
"swh_commit_count": 8432,
"swh_has_security_md": false,
"swh_has_dependabot": false,
"swh_has_github_actions": false,
"swh_has_tests_directory": true,
"swh_has_changelog": true,
"swh_security_fix_commit_count": 56,
"has_plugin_snapshot": true,
"required_core": "2.539",
"dependency_count": 7,
"security_warning_count": 8,
"active_security_warning_count": 0,
"release_timestamp": "2026-07-30T08:06:20+00:00",
"days_since_release": 101,
"dependency_plugins": [
"asm-api",
"commons-lang3-api",
"commons-text-api",
"jackson2-api",
"json-path-api",
"mailer",
"nimbus-jose-jwt-api"
],
"dependency_total": 7,
"dependency_risk_points": 10,
"dependency_risk_summary": {
"deps_with_any_advisory": 1,
"deps_with_recent_advisory_365d": 0,
"deps_with_active_warning": 0,
"worst_dep_max_cvss": 4.8,
"worst_dep_id": "mailer",
"worst_dep_latest_advisory_date": "2022-01-12"
},
"dependency_missing_data": {
"snapshot_missing": 1,
"advisories_missing": 1,
"healthscore_missing": 1
},
"dependency_details_top": [
{
"plugin_id": "mailer",
"advisory_count": 4,
"latest_advisory_date": "2022-01-12",
"recent_advisory_365d": false,
"max_cvss": 4.8,
"security_warning_count": 4,
"active_security_warning_count": 0,
"healthscore": 100,
"risk_points": 10,
"reasons": [
"4 advisories (+8).",
"Max CVSS 4.8 (+2)."
]
}
],
"healthscore_value": 100,
"healthscore_date": "2026-02-24T10:30:27.095608Z",
"healthscore_collected_at": "2026-02-28T16:43:20+00:00",
"score_components": {
"advisory_history": 12,
"advisory_severity": 15,
"staleness": 0,
"active_warnings": 0,
"governance": 6,
"dependency": 2,
"health_score": 0,
"security_sensitivity": 20
}
}
}