Security scorecards for open source projects