internal/

Package config loads all server configuration from the environment (design D10, 12-factor).

Package fallback fetches an existing latest Scorecard result from an upstream Scorecard API (e.g.

Package flags is the single seam for runtime feature flags (design FF1/FF5).

Package httpapi implements the Scorecard-webapp GET contract over the orchestrator (design D1/D11): GET /projects/{host}/{org}/{repo} (+ ?commit=), /badge, /capabilities, /health, and /readyz.

Package model defines a lean in-repo mirror of the OpenSSF Scorecard JSON2 wire format (Result), the repository reference the server routes on (RepoRef), and the provenance metadata (Provenance) that the server declares for every response.

Package orchestrator is the read-through cache and the central serve-vs-scan seam (design D2).

Package scan generates Scorecard results on demand by wrapping pkg/scorecard.Run (design D8).

Package store persists Scorecard results in a cloud-agnostic object store via gocloud.dev/blob.

Package tokens manages SCM credentials and rate limiting for live scans (design D8).