sigmaco.org

How we calculated the Flare Score based on positive and negative signals.

SSL certificate and security headers configuration

Transparency into our FlareScore™ methodology and data sources used for this analysis.

Domain Name System records and email security configuration

Key server response headers for security analysis.

{
    "date": "Mon, 20 Apr 2026 10:56:03 GMT",
    "content-length": "0",
    "location": "https:\/\/github.com\/sigmaco",
    "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
    "x-content-type-options": "nosniff",
    "report-to": "{\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y4XiWCdEdSunwR4pw6UIy7aa%2By2a2%2B1V99VZRuuSzUXSJGDcGlsEh8Kf2l%2BuoPTXRn7rAk1u9Ty6%2F0YNcPjuomNPP9beJ1vQzBLQxbSxPzvGI6vxJ2hHmuwlAiOp2w%3D%3D\"}]}",
    "nel": "{\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}",
    "expect-ct": "max-age=86400, enforce",
    "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
    "x-frame-options": "deny",
    "x-xss-protection": "0",
    "server": "github.com",
    "cf-ray": "9ef39ec91eb00bea-AMS",
    "alt-svc": "h3=\":443\"; ma=86400",
    "content-type": "text\/html; charset=utf-8",
    "vary": "X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, X-Requested-With, Sec-Fetch-Site,Accept-Encoding, Accept, X-Requested-With",
    "etag": "W\/\"6b57bce212cd976f728662d35665fc47\"",
    "cache-control": "max-age=0, private, must-revalidate",
    "content-security-policy": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com\/assets-cdn\/worker\/ github.com\/assets\/ gist.github.com\/assets-cdn\/worker\/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss:\/\/*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss:\/\/*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss:\/\/alive.github.com wss:\/\/alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net\/github-production-copilot-attachments\/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com\/assets-cdn\/worker\/ github.com\/assets\/ gist.github.com\/assets-cdn\/worker\/",
    "content-encoding": "gzip",
    "accept-ranges": "bytes",
    "set-cookie": "logged_in=no; expires=Tue, 20 Apr 2027 10:56:04 GMT; domain=.github.com; path=\/; HttpOnly; secure; SameSite=Lax",
    "x-github-request-id": "D20E:CB0BF:12C5A08F:DAFF029:69E60644"
}

Server location and network information

Canada

Toronto

Email security and authentication records (SPF, DKIM, DMARC).

Website loading speed and performance analysis

Checking if this domain is listed on major security blacklists.

Publicly accessible subdomains associated with this domain.

Share your experience with this site or ask questions. Your comments help the community.