I like the concept but I wouldn't be surprised if most of the security checks could be circumvented. my guess is the checks "is_china_country" and "is_risky_geo

I like the concept but I wouldn't be surprised if most of the security checks could be circumvented. my guess is the checks "is_china_country" and "is_risky_geo_location" can be trivially passed with a service like cloudflare. So essentially this would lead to a cat and mouse game. I would like to see something like this for OSS. Trust score that takes into account the maintainers of OSS components. For example if a maintainer is known for injecting protestware their "trustworthiness" score would indicate that. For example with this maintainer [1] refusing to adopt 2FA, the score should reflect that. [1] https://github.com/SheetJS/sheetjs/issues/2667 https://github.com/SheetJS/sheetjs/issues/2667