https://github.com/ossf/security-assessments/blob/4ca7a24767e522a4479098c155cbd1589bfcd0d7/guidance/getting-started.md#L23