Certified branches

A record that a person read this code and found nothing they considered unsafe. It covers one branch of one repository, because the same code on a release branch six months old is different code and a review of one says nothing about the other. It carries a note saying what was read and what was concluded, and the note is required: a badge whose only content is that somebody clicked a button cannot be argued with by the next person who has to rely on it.

It expires, and the date is required, because a review with no end date is a claim that nothing will ever change. And it goes amber the moment anybody pushes: the commit that was reviewed is recorded and compared with where the branch is now, so any new commit at all turns the badge, whether or not it produced a finding. Waiting for a finding would be the wrong test. A reviewer read some code, and different code has not been read.

An estate holds thousands of branches carrying nothing anybody would open, and asking a person to click a button on each of them produces a queue nobody works through and a coverage figure nobody believes. So a completed scan signs those off itself: no findings at all, or nothing above a low, which are the grades a reader passes over. The badge says a scan wrote it everywhere it is shown, and the report counts those apart from the ones a person reviewed, because "our engines found nothing" and "somebody read this" are different claims and only one of them is a review.

The whole feature rests on the word completed. A pass that did not run reports nothing, and nothing is exactly what a clear branch looks like, so an engine that died would otherwise be handed a green badge. A repository is only offered when the scanner says all four of its passes finished, and one whose worker died, whose code pass was cut short or whose credential walk covered only a window is not offered at all.

A scan may refresh or leave behind a badge it wrote itself. It may not overwrite one somebody signed, may not re-date it, and least of all may not revive one they withdrew. A branch marked as not expecting a review is left alone as well: somebody said no review was expected there, and a green badge is not a way of agreeing.

The denominator is branches, not repositories and not certifications. A count of certifications only ever goes up and tells nobody how much is left. Branches answer the question somebody looking at the figure is actually asking, and the branches counted are the ones scans have really walked rather than every ref that has ever existed on the host. Archived repositories and branches nobody is expected to review come out of the total entirely.

Nothing here removes a finding, changes a grade or keeps anything out of a report. A certified repository that starts producing criticals shows every one of them, beside a badge saying the review no longer covers what is there. The moment a certification can hide a finding it stops being one person's opinion and becomes everybody else's blind spot.

Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.