# What Verified means for Floe > Privacy only works if the security around it does. These are the outside checks on how Floe is built and released: what each one is, where Floe stands, and who vouches for it. Of the 13,613 projects on OpenSSF’s Best Practices list, 113 hold Gold and 102 meet every Baseline control at Level 3. ## SLSA build level: Level 3 A standard for how software gets built. At Level 3 a release is built by a hosted service, not on someone’s laptop, and comes with a signed record of which source it was built from. You can check that record against your download. Who says so: You can verify it yourself for any release. [slsa.dev](https://slsa.dev/spec/v1.0/levels) ## OpenSSF Best Practices: Silver A checklist from the Open Source Security Foundation for how a project is run, such as how changes get reviewed and how security reports are handled. It has three badges, Passing, Silver and Gold. Who says so: The project answers each item and publishes its evidence. [bestpractices.dev](https://www.bestpractices.dev/projects/15396) ## OpenSSF Baseline: Level 3 A shorter list of security controls every open source project should have, in three levels. Level 3 is the one meant for projects many people depend on. Who says so: The project answers these too, on the same public page. [baseline.openssf.org](https://baseline.openssf.org) ## OpenSSF Scorecard: 8.2 / 10 A tool that inspects the repository itself and scores it out of 10 on things such as whether changes are reviewed, dependencies are pinned and releases are signed. Who says so: Run by OpenSSF every week. The project cannot edit the score. [scorecard.dev](https://scorecard.dev/viewer/?uri=github.com/thaw-app/Floe) ## Test coverage: 86.5% The share of Floe’s code that its automated tests run. Who says so: SonarQube Cloud measures it on every change. [sonarcloud.io](https://sonarcloud.io/component_measures?id=thaw-app_Floe&metric=coverage) How to check a release yourself: [Verifying releases](https://www.getthaw.app/docs/floe/verifying-releases).