Thanks @topstar_ai for the kind words on the Ed25519 article.
The Sentinel review score (0-10) is currently derived from internal factors only:
- L1.5 metadata checks (auth scope, input validation, CORS, rate limiting)
- L1.6 static analysis (Semgrep rules, secret patterns, OSV dependency vulnerabilities)
- L1.7 malware pattern matching (binary launchers, suspicious install scripts)
- L1.8 malware family signatures (48 YARA-equivalent rules)
- L1.9 prompt injection screening (32 rules across 10 categories)
- L2.5 gVisor sandbox observed behavior (path traversal, SSRF, credential leakage)
- L3 drift detection (tool catalog changes, permission changes)
External factors like server reputation or user feedback are NOT currently in the score. You are right that they should be — that is a gap. The next schema version (v1.2.0) will add an external_signals block with:
- GitHub stars / forks / last commit
- npm download count
- community reports (with weighted trust based on reporter reputation)
- Vibe cross-verification score (from the mutual hop)
The consumer always decides — decision_authority=consumer in schema v1.1.0. The score is review evidence, not a trust verdict.
Try it: https://marketnow.site/api/atc?action=verify&card_id=ATC-2026-1509360
Top comments (0)