Lifeline resilience scorecard

ObaidAbdullah16/lifeline · 2026-11-08 14:01 UTC

Overall

6.3/10

fragile · coverage 66%

Domain & TLS

n/a

Access & bus factor

1.2

CI hygiene

10.0

Backup independence

5.0

Cost runway

10.0

Status	Check	Result	How to fix
SKIP	`LL-DOM-001` Domain registration does not expire soon	no domain (pass --domain, set `domain:` in lifeline.yml, or a repo homepage)
SKIP	`LL-DOM-002` TLS certificate is valid and not about to expire	no domain (pass --domain, set `domain:` in lifeline.yml, or a repo homepage)
SKIP	`LL-DOM-003` CAA record limits which CAs may issue certificates	no domain (pass --domain, set `domain:` in lifeline.yml, or a repo homepage)
SKIP	`LL-DOM-004` DNSSEC is enabled and validates	no domain (pass --domain, set `domain:` in lifeline.yml, or a repo homepage)
SKIP	`LL-DOM-005` SPF and DMARC protect the domain from email spoofing	no domain (pass --domain, set `domain:` in lifeline.yml, or a repo homepage)
SKIP	`LL-DOM-006` Outgoing email is signed with DKIM	no domain (pass --domain, set `domain:` in lifeline.yml, or a repo homepage)
SKIP	`LL-DOM-007` SPF stays within the 10-DNS-lookup limit	no domain (pass --domain, set `domain:` in lifeline.yml, or a repo homepage)
FAIL	`LL-ACC-001` More than one person can administer the project	owned by the personal account "ObaidAbdullah16": one person holds every key	Move the repository to a GitHub organisation with 2-5 owners. Store recovery codes for the registrar, DNS and cloud accounts somewhere a second maintainer can reach.
SKIP	`LL-ACC-002` Organisation requires two-factor authentication	personal account: 2FA enforcement is an organisation setting (turn on 2FA for your own account)
FAIL	`LL-ACC-003` Default branch is protected	main has no branch protection: anyone with write access can force-push or delete it	Add a ruleset for the default branch: require pull requests, block force pushes and deletions.
FAIL	`LL-ACC-004` Work is not concentrated in one maintainer (bus factor)	bus factor 1: 1 author(s) made 80% of the last 2 commits (180 days) ObaidAbdullah16: 2 commits	Document how to release and deploy, give a second maintainer access, and pair on at least one release.
PASS	`LL-ACC-005` A security contact is published	security_contact set in lifeline.yml: GitHub private vulnerability reporting (Security tab > Report a vulnerability)
PASS	`LL-CI-001` Actions are pinned to commit SHAs	15 of 15 action references pinned (100%)
PASS	`LL-CI-002` Workflow token permissions are restricted	all 3 workflow(s) declare token permissions
PASS	`LL-CI-003` No privileged workflow runs untrusted pull-request code	no pull_request_target, workflow_run or issue_comment job checks out pull-request code
PASS	`LL-CI-004` Cloud access uses short-lived OIDC credentials	no stored cloud keys found; workflows request short-lived OIDC tokens (id-token: write)
PASS	`LL-CI-005` Dependencies and actions are updated automatically	Dependabot updates: github-actions, gomod, docker, pip
PASS	`LL-BAK-001` Backups are declared for stateful data	1 backup(s) declared git repository: source code and release tags (issues and discussions are not included) -> GitHub only
FAIL	`LL-BAK-002` Restores have been tested recently	a backup was never restored or not for over 180 days git repository: never restored	Restore each backup into a sandbox at least every 90 days, check the data, record the date in lifeline.yml (restore-drill-kit automates this).
WARN	`LL-BAK-003` Backups are isolated from production credentials	some backups may be deletable with production credentials git repository (isolated: false)	Keep backups in a separate account/project or with object lock, so whoever (or whatever AI agent) can delete production cannot delete the backups.
PASS	`LL-COST-001` Infrastructure money lasts at least six months	no recurring infrastructure spend declared
SKIP	`LL-COST-002` Billing alerts are configured	ignored in lifeline.yml

Generated by Lifeline action. Skipped checks need a token, a domain or a lifeline.yml.