Satisfies vulnerability_report_process/know_secure_design/know_common_errors via SECURITY.md; delivery_unsigned via GPG-signed releases (public key in docs/signing-key.asc); N/A justifications for the 4 N/A-able MUST criteria (crypto_password_storage, vulnerability_report_private, vulnerability_report_response, release_notes_vulns). Backs the OpenSSF Best Practices passing badge and closes the CIIBestPracticesID alert.
The scripts/cii_criteria.py helper fetches bestpractices.dev criteria
and generates pre-filled edit URLs for each criterion, streamlining
badge maintenance. CONTRIBUTING.md backs the contribution and testing
criteria referenced by the CII best-practices submission.
Devid HW