Update, 28 October 2026, evening. After this note was published we changed the check at tokenizen.nl/en/cra-check so that it also reads the pipeline file of Jenkins, GitLab CI, Azure Pipelines, Bitbucket Pipelines, Travis, Drone and CircleCI when it sits at the root of a repository (rule set 2026-10-28.7). The Trivy scan in a Jenkinsfile that this note mentions as a miss is now seen. We ran the measurement again. GitHub's search results had shifted a little, and the counts moved by at most three repositories per signal: a security scan was visible in 16 of 104 repositories, a bill of materials in 5 of 102 and a security policy with a contact in 18 of 106. Where the text below says that only GitHub Actions is read, that is no longer true; the other limits stand.…