github.com/CalyxOS/releases (link)

the signals and their derived score are provisional and subject to change.

validate manually before sharing.