git.busybox.net/busybox (link)

the signals and their derived score are provisional and subject to change.

validate manually before sharing.