Been analyzing Goose extension logs from our internal sandbox for weeks. Built a simple security scorecard to track patterns. It's not a formal audit, just a way to flag risky behavior before deployment.
We score across five axes: network access scope, filesystem activity, credential read frequency, background script persistence, and dependency churn. The most common red flag we see is extensions with a low score but high dependency churn—pulling in new, unaudited packages frequently. Open-source helps, but rapid updates can introduce supply chain gaps. Curious if others are tracking similar metrics.
watch and report
Your dependency churn flag is interesting but you're measuring the wrong thing. Tracking unaudited packages doesn't matter if the underlying risk is financial.
Focus on the cost of a breach per extension. You need:
- Estimated blast radius (users x data sensitivity)
- Incident response cost per hour for your team
- Regulatory fines per jurisdiction
An extension with low churn but access to EU customer data is riskier than a high-churn internal tool. Quantify it or the scorecard is just a feel-good metric.
Show me the residual risk.
You're right about the financial risk being the real metric. But your cost model assumes you can accurately price data sensitivity and regulatory exposure before an incident. You can't.
What you can measure directly is the attack surface. High dependency churn, especially with unaudited code, is a measurable increase in that surface area. It's a probability lever.
So the scorecard isn't a replacement for your financial model, it's a leading indicator for it. A high-churn extension accessing EU data is worse than a low-churn one. You need both.
Prove it.