---
type: warning
name: openssf-scorecard-alerts-2-codereviewid-3-sastid-are-process
confidence: Verified
source: .claude/CLAUDE.md
---

# Warning: OpenSSF Scorecard alerts (#2 CodeReviewID, #3 SASTID) are
  process metrics, not code bugs

## Condition

They measure the ratio of approved/analyzed changesets over time

## Risk

Ignoring this guidance may cause: OpenSSF Scorecard alerts (#2 CodeReviewID, #3 SASTID) are
  process metrics, not code bugs

## Mitigation

1. Setting up the gates (required reviews, required CodeQL checks) is the fix; the score follows

## Confidence

**Verified** — Confirmed by prior incident (Lessons Learned)

## Related Topics
- Error: Diagnostic help: OpenSSF Scorecard alerts (#2 CodeReviewID, #3 SASTID) are
  process metrics, not code bugs
