[oschaaf]

Enrol projects/mod_pagespeed

I have verified each of the following before submitting this project (tick each box by changing [ ] to [x]):

• I am a core maintainer of this project.
• I accept the OSS Scanner terms.
• I confirm that I believe my project meets the inclusion criteria and is an established project that users depend on.
• project.yaml follows the README (one project per PR; tools/validate.py passes locally).
• tools/check <name> builds the project, and its tests run in the shell that follows.
• primary_contact must be the email address of the primary security contact.
• There is a Dockerfile that builds the project (required) in one of two places: in the project's repository at the path dockerfile: names, or next to project.yaml in this repo.
• threat_model.md is written for this project (recommended but optional), placed in the same way: in the repository at the path threat_model: names, or next to project.yaml in this repo.

To sign the CLA, post a comment on this pull request that contains only this line: I have read the CLA Document and I hereby sign the CLA

To change an enrolment, edit project.yaml; to pause reports, set disabled: true; to withdraw the project, remove projects/<name>/.

Context (optional): if you believe it is not obvious why your project qualifies for our inclusion criteria, you may write a brief note here to explain why you feel it does.

mod_pagespeed is the web-server module family (Apache, nginx, IIS, Envoy) that rewrites HTML in flight and re-encodes the images, CSS and JavaScript a page references. It runs inside the server's worker processes and parses every byte of origin content and every request URL, so it sits squarely in the "processes untrusted input, exposed to remote attacks" class. The project dates from 2010; We-Amp helped build ngx_pagespeed and maintained mod_pagespeed throughout the Google era, and has carried the project since the Apache incubator archived it, under the Apache-2.0 licence. The installed base is large and mostly old: in HTTP Archive's September 2026 crawl, 39,564 origins send a mod_pagespeed or ngx_pagespeed header, and 20,625 of them name a version, 99.9% of those a release from 2020 or earlier. The lineage has shipped CVE fixes for remote issues before (CVE-2012-4001, CVE-2012-4360, CVE-2013-6111). Today's tree carries HTML, CSS, JavaScript and rule-pack fuzz harnesses and a sanitizer CI, and the security contact in project.yaml is the one in the repository's SECURITY.md. The Dockerfile and threat model live in the repository under .oss-scanner/. tools/check --no-shell mod_pagespeed ran clean against master on 2026-10-21 (31 minutes wall on a 128-core box, of which the Bazel build and test step took 23 minutes; the image compiles the module for Apache and nginx, the kernel unit tests and the fuzz harnesses, and leaves Bazel's output tree in place so the agent's builds and tests are incremental). The build step is close to the 45-minute budget on a smaller builder; if it times out on your side, tell us and we will trim the prebuilt target set.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Enrolment triage: projects/mod_pagespeed

Repository: We-Amp/mod_pagespeed at master · opened by oschaaf

	Check	Result
✅	Repository	created 3 years ago, last push today
ℹ️	Stars / forks	24 stars · 10 forks · 2 watching
ℹ️	Outside participants	3 people from outside the project opened 6 of the last 67 issues and pull requests
ℹ️	Criticality score	0.47 on the OpenSSF scale of 0 to 1 signals created_since 198, updated_since 0, contributor_count 60, org_count 4, commit_frequency 8.0, recent_releases_count 1, closed_issues_count 120, updated_issues_count 122, comment_frequency 0.3, dependents_count 5
ℹ️	Package rank	by downloads: nothing from this repository found in the top 15,000 on PyPI or the top 10,000 on npm
✅	License	Apache-2.0
✅	Opened by an active maintainer	member of the owning organisation; 100+ commits in the last 12 months; #4 contributor
✅	Contact in SECURITY.md	security@modpagespeed.com is in SECURITY.md
ℹ️	OSS-Fuzz	not found in OSS-Fuzz
✅	.oss-scanner/ in the repository	present (Dockerfile, threat_model.md); Dockerfile at .oss-scanner/Dockerfile
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
✅	Checklist	all 8 ticked

_{Automated, from public data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}

[oschaaf]

I have read the CLA Document and I hereby sign the CLA