CNA Scorecard

---

🎯 What is CNA Scorecard?

CNA Scorecard is an automated system that measures how completely CVE Numbering Authorities (CNAs) populate vulnerability records. By analyzing the most recent 6 months of CVE data, we provide transparent, data-driven insights that help:

• Security Teams → Understand which CNAs provide the most actionable vulnerability data
• CNAs → Identify areas for improvement in their disclosure practices
• Researchers → Track ecosystem-wide trends in vulnerability data quality
• Organizations → Make informed decisions about vulnerability prioritization

💡 Why 6 months? We focus on recent data to reflect current CNA practices, not historical baggage. This gives CNAs credit for improvements and provides users with relevant, actionable insights.

---

✨ Key Features

Feature	Description
🏆 CNA Rankings	Live leaderboard of 300+ CNAs ranked by data completeness
📊 5-Category Scoring	Comprehensive scoring across foundational, root cause, severity, software ID, and patch info
📈 Trend Analysis	Track how CNA performance evolves over time with rolling 7-day charts
🔍 Individual Profiles	Deep-dive into any CNA's recent CVEs with per-record scoring
📱 Mobile-First Design	Fully responsive interface optimized for all devices
🏅 Embeddable Badges	SVG badges CNAs can display on their sites (auto-updated every 6h)
📤 Data Export	Download rankings and CVE data in CSV or JSON format
♿ Accessible	WCAG-compliant with skip links, ARIA labels, and keyboard navigation
⚡ Always Fresh	Automated pipeline updates data every 6 hours via GitHub Actions

---

📊 Scoring Methodology

Each CVE record is scored on a 100-point scale across five categories:

┌─────────────────────────────────────────────────────────────────┐
│  FOUNDATIONAL COMPLETENESS (50 pts)                             │
│  ├── Description quality and detail                             │
│  ├── Affected products clearly identified                       │
│  └── Reference URLs provided                                    │
├─────────────────────────────────────────────────────────────────┤
│  ROOT CAUSE ANALYSIS (15 pts)                                   │
│  └── CWE (Common Weakness Enumeration) identifier               │
├─────────────────────────────────────────────────────────────────┤
│  SEVERITY & IMPACT (15 pts)                                     │
│  └── CVSS score with vector string                              │
├─────────────────────────────────────────────────────────────────┤
│  SOFTWARE IDENTIFICATION (10 pts)                               │
│  └── CPE (incl. cpeApplicability) or unversioned Package URL    │
├─────────────────────────────────────────────────────────────────┤
│  PATCH INFORMATION (10 pts)                                     │
│  └── References tagged as patches/fixes                         │
└─────────────────────────────────────────────────────────────────┘

Grade Thresholds:

• 🥇 A+ (97-100%) - Exceptional data quality
• 🥈 A (90-96%) - Excellent completeness
• 🥉 B (80-89%) - Good, room for improvement
• C (70-79%) - Adequate but missing key fields
• D (60-69%) - Below expectations
• F (<60%) - Significant data gaps

📖 Full methodology details: cnascorecard.org/scoring.html

---

🚀 Quick Start

View the Live Scorecard

Visit cnascorecard.org to explore CNA rankings, trends, and individual profiles.

Run Locally

# Clone the repository
git clone https://github.com/RogoLabs/CNAScoreCard.git
cd CNAScoreCard

# Install Python dependencies
pip install -r requirements.txt

# Run the data pipeline (analyzes last 6 months of CVE data)
python cnascorecard_pipeline/pipeline.py

# Serve the web interface
cd web && python -m http.server 8000
# Open http://localhost:8000 in your browser

Run with Custom Date Range

python cnascorecard_pipeline/pipeline.py \
  --start-date 2024-01-01 \
  --end-date 2024-06-30 \
  --output-dir ./custom-output

---

🏅 CNA Badges

Display your CNA Scorecard rating on your website, README, or security advisories:

Get Your Badge

1. Visit the Badge Generator
2. Search for your CNA
3. Copy the Markdown or HTML code

Markdown Example:

[![CNA Scorecard](https://cnascorecard.org/badges/YourCNA-rank.svg)](https://cnascorecard.org/cna/cna-detail.html?shortName=YourCNA)

HTML Example:

<a href="https://cnascorecard.org/cna/cna-detail.html?shortName=YourCNA">
  <img src="https://cnascorecard.org/badges/YourCNA-combined.svg" alt="CNA Scorecard">
</a>

Badges are color-coded by score and auto-update every 6 hours.

---

🏗️ Architecture

CNAScoreCard/
├── cnascorecard_pipeline/     # Python data pipeline
│   ├── pipeline.py            # Main orchestrator
│   ├── ingest.py              # CVE data loading & filtering
│   ├── scoring.py             # 5-category scoring engine
│   ├── aggregation.py         # CNA statistics & rankings
│   ├── completeness.py        # Field utilization analysis
│   ├── trends.py              # Historical trend calculations
│   └── config.py              # Configuration & rules
│
├── web/                       # Static web frontend
│   ├── index.html             # Homepage dashboard
│   ├── cna/                   # CNA leaderboard & profiles
│   ├── completeness/          # Field completeness analysis
│   ├── trends.html            # Performance trend charts
│   ├── scoring.html           # Methodology documentation
│   ├── badges.html            # Badge generator
│   └── data/                  # JSON data files (auto-generated)
│
├── cve_data/                  # CVE source data (gitignored)
└── .github/workflows/         # GitHub Actions automation

여기까지가 README 앞부분입니다. 나머지는 원문에서 읽을 수 있습니다. README 전문 보기 ↗