OpenPulseMethodology
OpenPulse is designed to be inspectable. These are the principles that govern what we claim, how strongly we claim it, and where we stop.
Trust principles
Evidence-first
Every finding links to the sources it came from. If we cannot show the evidence, we do not assert the change.
Confidence-aware
Findings carry an explicit confidence level so you can decide how much weight to give them.
Identity-aware
Similar names are not the same identity. A package, an image and a repository are distinct things.
Uncertainty-aware
Unknown is reported as unknown. We never convert missing information into reassurance.
No opaque risk score
There is no single magic number. You see what changed, what it might affect, and why we believe it.
Distinctions we never collapse
A dependency appearing near a change is not proof it is affected by that change.
A change to a project does not mean every version of it is impacted.
Absence of evidence is not evidence of safety. Unknown stays unknown.
Confidence levels
Directly verified in authoritative upstream sources.
Supported by multiple independent sources.
Early signals present; the situation is still developing.
Reported but not yet independently supported.
What OpenPulse does not claim
OpenPulse does not prevent supply-chain attacks, eliminate dependency risk, or replace your existing security tooling. It answers one question well: what is changing upstream, and what might that change mean for software that depends on it?