Scorecard: track self-resolving/optional findings — Maintained, SAST window, CII badge (alerts #5, #6, #7)

[DocGerd]

Findings (self-resolving or optional — tracked, not fixable by a code change)

• Scorecard alert Phase B: routing domain core #5 (Maintained, score 0): "project was created within the last 90 days". The check scores 0 for ANY repo younger than 90 days regardless of activity. Self-resolves around 2026-10-12 given continued commit/issue activity.
• Scorecard alert Chart features: buoys, beacons and other seamarks on the map (and optionally in routing) #7 (SAST, score 8): "17 of 30 commits checked with a SAST tool". The 30-commit window reaches back before CodeQL was enabled (2026-07-17, PR ci: add CodeQL scanning (JS/TS + Python) #56). The ratio climbs toward 30/30 automatically as new commits land — no action available beyond continuing to merge through CI.
• Scorecard alert Mask: 14 of 44 harbors disconnected from open water at default safety depth (incl. Flensburg) #6 (CII-Best-Practices, score 0): no OpenSSF Best Practices badge. This requires enrolling the project at bestpractices.dev and self-certifying the criteria — an optional program, worth doing only if the public-trust signal matters for this repo.

Action

• No code changes. Re-check all three after ~2026-10-15.
• If Phase B: routing domain core #5 and Chart features: buoys, beacons and other seamarks on the map (and optionally in routing) #7 have not closed by then despite sustained activity, investigate; otherwise close this issue when both alerts auto-resolve.
• Decide separately whether the CII badge enrollment (Mask: 14 of 44 harbors disconnected from open water at default safety depth (incl. Flensburg) #6) is worth the questionnaire effort; if not, dismiss alert Mask: 14 of 44 harbors disconnected from open water at default safety depth (incl. Flensburg) #6 as "won't fix" and note it in SECURITY.md.